CVE-2026-23471
published 2026-04-03CVE-2026-23471: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug In the Linux kernel, the following vulnerability has been resolved: drm…
medium5.5
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
In the Linux kernel, the following vulnerability has been resolved:
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
When trying to do a rather aggressive test of igt's "xe_module_load
--r reload" with a full desktop environment and game running I noticed
a few OOPSes when dereferencing freed pointers, related to
framebuffers and property blobs after the compositor exits.
Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
and immediately put the references from struct drm_file objects during
drm_dev_unplug().
Related warnings for framebuffers on the subtest:
[ 739.713076] ------------[ cut here ]------------
WARN_ON(!list_empty(&dev->mode_config.fb_list))
[ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at drm_mode_config_cleanup+0x30b/0x320 [drm], CPU#12: xe_module_load/13145
....
[ 739.713328] Call Trace:
[ 739.713330]
[ 739.713335] ? intel_pmdemand_destroy_state+0x11/0x20 [xe]
[ 739.713574] ? intel_atomic_global_obj_cleanup+0xe4/0x1a0 [xe]
[ 739.713794] intel_display_driver_remove_noirq+0x51/0xb0 [xe]
[ 739.714041] xe_display_fini_early+0x33/0x50 [xe]
[ 739.714284] devm_action_release+0xf/0x20
[ 739.714294] devres_release_all+0xad/0xf0
[ 739.714301] device_unbind_cleanup+0x12/0xa0
[ 739.714305] device_release_driver_internal+0x1b7/0x210
[ 739.714311] device_driver_detach+0x14/0x20
[ 739.714315] unbind_store+0xa6/0xb0
[ 739.714319] drv_attr_store+0x21/0x30
[ 739.714322] sysfs_kf_write+0x48/0x60
[ 739.714328] kernfs_fop_write_iter+0x16b/0x240
[ 739.714333] vfs_write+0x266/0x520
[ 739.714341] ksys_write+0x72/0xe0
[ 739.714345] __x64_sys_write+0x19/0x20
[ 739.714347] x64_sys_call+0xa15/0xa30
[ 739.714355] do_syscall_64+0xd8/0xab0
[ 739.714361] entry_SYSCALL_64_after_hwframe+0x4b/0x53
and
[ 739.714459] ------------[ cut here ]------------
[ 739.714461] xe 0000:67:00.0: [drm] drm_WARN_ON(!list_empty(&fb->fi
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.10-1 (forky) | linux 6.19.10-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= bee330f3d67273a68dcb99f59480d59553c008b2 < 54df178324b268c62f847381e2813a1b0f971384 | 54df178324b268c62f847381e2813a1b0f971384 |
| linux | linux | >= bee330f3d67273a68dcb99f59480d59553c008b2 < eec4d5758f33925e0bdb4a32b45d86a68afa4516 | eec4d5758f33925e0bdb4a32b45d86a68afa4516 |
| linux | linux | >= bee330f3d67273a68dcb99f59480d59553c008b2 < 7e3ec3bf4015156dcc5bafed13f26a587cc37f5c | 7e3ec3bf4015156dcc5bafed13f26a587cc37f5c |
| linux | linux | >= bee330f3d67273a68dcb99f59480d59553c008b2 < 074d06d3724ccab0c5bb779db594a82b6405e501 | 074d06d3724ccab0c5bb779db594a82b6405e501 |
| linux | linux | >= bee330f3d67273a68dcb99f59480d59553c008b2 < e493c135980f90c20308d1a98f2e0d1223951e94 | e493c135980f90c20308d1a98f2e0d1223951e94 |
| linux | linux | >= bee330f3d67273a68dcb99f59480d59553c008b2 < 6bee098b91417654703e17eb5c1822c6dfd0c01d | 6bee098b91417654703e17eb5c1822c6dfd0c01d |
| linux | linux_kernel | >= 0 < 6.19.10-1 | 6.19.10-1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
vendor_redhat·2026-04-03·CVSS 5.5
CVE-2026-23471 [MEDIUM] CWE-825 kernel: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
kernel: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
In the Linux kernel, the following vulnerability has been resolved:
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
When trying to do a rather aggressive test of igt's "xe_module_load
--r reload" with a full desktop environment and game running I noticed
a few OOPSes when dereferencing freed pointers, related to
framebuffers and property blobs after the compositor exits.
Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
and immediately put the references from struct drm_file objects during
drm_dev_unplug().
Related warnings for framebuffers on the subtest:
[ 739.713076] ------------[ cut here ]------------
WARN_ON(!list_empty(&dev->mod
Debian
CVE-2026-23471: linux - In the Linux kernel, the following vulnerability has been resolved: drm: Fix us...
vendor_debian·2026
CVE-2026-23471 CVE-2026-23471: linux - In the Linux kernel, the following vulnerability has been resolved: drm: Fix us...
In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug When trying to do a rather aggressive test of igt's "xe_module_load --r reload" with a full desktop environment and game running I noticed a few OOPSes when dereferencing freed pointers, related to framebuffers and property blobs after the compositor exits. Solve this by guarding the freeing in drm_file with drm_dev_enter/exit, and immediately put the references from struct drm_file objects during drm_dev_unplug(). Related warnings for framebuffers on the subtest: [ 739.713076] ------------[ cut here ]------------ WARN_ON(!list_empty(&dev->mode_config.fb_list)) [ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at drm_mode_conf
GHSA
GHSA-9h7x-8rrr-c9c7: In the Linux kernel, the following vulnerability has been resolved:
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_u
ghsa_unreviewed·2026-04-03
CVE-2026-23471 GHSA-9h7x-8rrr-c9c7: In the Linux kernel, the following vulnerability has been resolved:
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_u
In the Linux kernel, the following vulnerability has been resolved:
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
When trying to do a rather aggressive test of igt's "xe_module_load
--r reload" with a full desktop environment and game running I noticed
a few OOPSes when dereferencing freed pointers, related to
framebuffers and property blobs after the compositor exits.
Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
and immediately put the references from struct drm_file objects during
drm_dev_unplug().
Related warnings for framebuffers on the subtest:
[ 739.713076] ------------[ cut here ]------------
WARN_ON(!list_empty(&dev->mode_config.fb_list))
[ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at drm_mode_
OSV
CVE-2026-23471: In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_un
osv·2026-04-03
CVE-2026-23471 CVE-2026-23471: In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_un
In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug When trying to do a rather aggressive test of igt's "xe_module_load --r reload" with a full desktop environment and game running I noticed a few OOPSes when dereferencing freed pointers, related to framebuffers and property blobs after the compositor exits. Solve this by guarding the freeing in drm_file with drm_dev_enter/exit, and immediately put the references from struct drm_file objects during drm_dev_unplug(). Related warnings for framebuffers on the subtest: [ 739.713076] ------------[ cut here ]------------ WARN_ON(!list_empty(&dev->mode_config.fb_list)) [ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at drm_mode_conf
CVEList
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
cvelistv5·2026-04-03
CVE-2026-23471 drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
In the Linux kernel, the following vulnerability has been resolved:
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
When trying to do a rather aggressive test of igt's "xe_module_load
--r reload" with a full desktop environment and game running I noticed
a few OOPSes when dereferencing freed pointers, related to
framebuffers and property blobs after the compositor exits.
Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
and immediately put the references from struct drm_file objects during
drm_dev_unplug().
Related warnings for framebuffers on the subtest:
[ 739.713076] ------------[ cut here ]------------
WARN_ON(!list_empty(&dev->mode_co
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-23471 kernel: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
bugzilla·2026-04-03
CVE-2026-23471 CVE-2026-23471 kernel: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
CVE-2026-23471 kernel: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
In the Linux kernel, the following vulnerability has been resolved:
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
When trying to do a rather aggressive test of igt's "xe_module_load
--r reload" with a full desktop environment and game running I noticed
a few OOPSes when dereferencing freed pointers, related to
framebuffers and property blobs after the compositor exits.
Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
and immediately put the references from struct drm_file objects during
drm_dev_unplug().
Related warnings for framebuffers on the subtest:
[ 739.713076] ------------[ cut here ]------------
WARN_ON(!l
Wiz
CVE-2026-23471 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-23471 CVE-2026-23471 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23471 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
When trying to do a rather aggressive test of igt's "xe_module_load
--r reload" with a full desktop environment and game running I noticed
a few OOPSes when dereferencing freed pointers, related to
framebuffers and property blobs after the compositor exits.
Solve this by guarding the freeing in drm_file with drm_dev_enter/exit,
and immediately put the references from struct drm_file objects during
drm_dev_unplug().
Related warnings for framebuffers on the subtest:
[ 739.713076] ------------[ cut here ]------------
WARN_ON(!list_empty(&dev->mode_config.fb_list))
2026-04-03
Published