CVE-2026-23227

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23227
In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free Exynos Virtual Display driver performs memory alloc/free operations without lock protection, which easily causes concurrency problem. For example, use-after-free can occur in race scenario like this: ``` CPU0 CPU1 CPU2 ---- ---- ---- vidi_connection_ioctl() if (vidi->connection) // true drm_edid = drm_edid_alloc(); // alloc drm_edid ... ctx->raw_edid = drm_edid; ... drm_mode_getconnector() drm_helper_probe_single_connector_modes() vidi_get_modes() if (ctx->raw_edid) // true drm_edid_dup(ctx->raw_edid); if (!drm_edid) // false ... vidi_connection_ioctl() if (vidi->connection) // false drm_edid_free(ctx->raw_edid); // free drm_edid ... drm_edid_alloc(drm_edid->edid) kmemdup(edid); // UAF!! ... ``` To prevent these vulns, at least in vidi_context, member variables related to memory alloc/free should be protected with ctx->lock.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0cd2c155740dbd00868ac5a8ae5d14cd6b9ed385 Patch
https://git.kernel.org/stable/c/1b24d3e8792bcc050c70e8e0dea6b49c4fc63b13
https://git.kernel.org/stable/c/52b330799e2d6f825ae2bb74662ec1b10eb954bb Patch
https://git.kernel.org/stable/c/60b75407c172e1f341a8a5097c5cbc97dbbdd893 Patch
https://git.kernel.org/stable/c/92dd1f38d7db75374dcdaf54f1d79d67bffd54e5
https://git.kernel.org/stable/c/abfdf449fb3d7b42e85a1ad1c8694b768b1582f4 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

25 Mar 2026, 11:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/1b24d3e8792bcc050c70e8e0dea6b49c4fc63b13 -
  • () https://git.kernel.org/stable/c/92dd1f38d7db75374dcdaf54f1d79d67bffd54e5 -

18 Mar 2026, 14:40

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/0cd2c155740dbd00868ac5a8ae5d14cd6b9ed385 - () https://git.kernel.org/stable/c/0cd2c155740dbd00868ac5a8ae5d14cd6b9ed385 - Patch
References () https://git.kernel.org/stable/c/52b330799e2d6f825ae2bb74662ec1b10eb954bb - () https://git.kernel.org/stable/c/52b330799e2d6f825ae2bb74662ec1b10eb954bb - Patch
References () https://git.kernel.org/stable/c/60b75407c172e1f341a8a5097c5cbc97dbbdd893 - () https://git.kernel.org/stable/c/60b75407c172e1f341a8a5097c5cbc97dbbdd893 - Patch
References () https://git.kernel.org/stable/c/abfdf449fb3d7b42e85a1ad1c8694b768b1582f4 - () https://git.kernel.org/stable/c/abfdf449fb3d7b42e85a1ad1c8694b768b1582f4 - Patch
First Time Linux
Linux linux Kernel
CWE CWE-416

13 Mar 2026, 19:54

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/abfdf449fb3d7b42e85a1ad1c8694b768b1582f4 -

23 Feb 2026, 04:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/52b330799e2d6f825ae2bb74662ec1b10eb954bb -
Summary
  • (es) Se ha resuelto la siguiente vulnerabilidad en el kernel de Linux: drm/exynos: vidi: usar ctx->lock para proteger las variables miembro de la estructura vidi_context relacionadas con la asignación/liberación de memoria El controlador de pantalla virtual de Exynos realiza operaciones de asignación/liberación de memoria sin protección de bloqueo, lo que fácilmente causa un problema de concurrencia. Por ejemplo, el uso después de liberación puede ocurrir en un escenario de carrera como este: ``` CPU0 CPU1 CPU2 ---- ---- ---- vidi_connection_ioctl() if (vidi->connection) // true drm_edid = drm_edid_alloc(); // alloc drm_edid ... ctx->raw_edid = drm_edid; ... drm_mode_getconnector() drm_helper_probe_single_connector_modes() vidi_get_modes() if (ctx->raw_edid) // true drm_edid_dup(ctx->raw_edid); if (!drm_edid) // false ... vidi_connection_ioctl() if (vidi->connection) // false drm_edid_free(ctx->raw_edid); // free drm_edid ... drm_edid_alloc(drm_edid->edid) kmemdup(edid); // UAF!! ... ``` Para prevenir estas vulnerabilidades, al menos en vidi_context, las variables miembro relacionadas con la asignación/liberación de memoria deberían ser protegidas con ctx->lock.

18 Feb 2026, 16:22

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-18 16:22

Updated : 2026-03-25 11:16

NVD link : CVE-2026-23227

Mitre link : CVE-2026-23227

CVE.ORG link : CVE-2026-23227

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free