CVE-2026-23366

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23366
In the Linux kernel, the following vulnerability has been resolved: drm/client: Do not destroy NULL modes 'modes' in drm_client_modeset_probe may fail to kcalloc. If this occurs, we jump to 'out', calling modes_destroy on it, which dereferences it. This may result in a NULL pointer dereference in the error case. Prevent that.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/4e3ca5f82346cc23c0a71f1ceb006115ff6b0745 Patch
https://git.kernel.org/stable/c/9aa3e33f0c7f2679ac599a09e3102c8f716a6321 Patch
https://git.kernel.org/stable/c/c601fd5414315fc515f746b499110e46272e7243 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
History

24 Apr 2026, 18:41

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/4e3ca5f82346cc23c0a71f1ceb006115ff6b0745 - () https://git.kernel.org/stable/c/4e3ca5f82346cc23c0a71f1ceb006115ff6b0745 - Patch
References () https://git.kernel.org/stable/c/9aa3e33f0c7f2679ac599a09e3102c8f716a6321 - () https://git.kernel.org/stable/c/9aa3e33f0c7f2679ac599a09e3102c8f716a6321 - Patch
References () https://git.kernel.org/stable/c/c601fd5414315fc515f746b499110e46272e7243 - () https://git.kernel.org/stable/c/c601fd5414315fc515f746b499110e46272e7243 - Patch
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: drm/cliente: No destruir modos NULL 'modes' en drm_client_modeset_probe puede fallar al kcalloc. Si esto ocurre, saltamos a 'out', llamando a modes_destroy sobre él, lo que lo desreferencia. Esto puede resultar en una desreferencia de puntero NULL en el caso de error. Prevenir eso.
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-476
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*

25 Mar 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-25 11:16

Updated : 2026-04-24 18:41

NVD link : CVE-2026-23366

Mitre link : CVE-2026-23366

CVE.ORG link : CVE-2026-23366

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference