LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43236: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release

In the Linux kernel, the following vulnerability has been resolved: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying the atmel_hlcdc_plane state structure without properly duplicating the drm_plane_state. In particular, state->commit remained set to the old state commit, which can lead to a use-after-free in the next drm_atomic_commit() call. Fix this by calling __drm_atomic_helper_duplicate_plane_state(), which correctly clones the base drm_plane_state (including the ->commit pointer). It has been seen when closing and re-opening the device node while another DRM client (e.g. fbdev) is still attached: ============================================================================= BUG kmalloc-64 (Not tainted): Poison overwritten ----------------------------------------------------------------------------- 0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0 pid=29 drm_atomic_helper_setup_commit+0x1e8/0x7bc drm_atomic_helper_commit+0x3c/0x15c drm_atomic_commit+0xc0/0xf4 drm_framebuffer_remove+0x4cc/0x5a8 drm_mode_rmfb_work_fn+0x6c/0x80 process_one_work+0x12c/0x2cc worker_thread+0x2a8/0x400 kthread+0xc0/0xdc ret_from_fork+0x14/0x28 Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0 pid=169 drm_atomic_helper_commit_hw_done+0x100/0x150 drm_atomic_helper_commit_tail+0x64/0x8c commit_tail+0x168/0x18c drm_atomic_helper_commit+0x138/0x15c drm_atomic_commit+0xc0/0xf4 drm_atomic_helper_set_config+0x84/0xb8 drm_mode_setcrtc+0x32c/0x810 drm_ioctl+0x20c/0x488 sys_ioctl+0x14c/0xc20 ret_fast_syscall+0x0/0x54 Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0 flags=0x200(workingset|zone=0) Object 0xc611b340 @offset=832 fp=0xc611b7c0

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux display-driver flaw can leave a reference to freed kernel memory. A locally authenticated user able to access the affected Atmel HLCDC graphics device could potentially crash the system or compromise confidentiality and integrity. The supplied CVSS score is 7.8, but no active exploitation is reported.

Executive priority

Treat as a high-priority local kernel issue on confirmed Atmel HLCDC systems, especially shared, kiosk, embedded, or appliance environments. It is not described as remotely exploitable, and active exploitation is unconfirmed. Patch confirmed exposure promptly through supported kernel updates rather than treating every Linux host as affected.

Technical view

atmel_hlcdc_plane_atomic_duplicate_state() copied driver state without correctly duplicating the base drm_plane_state. Its commit pointer could therefore reference a released drm_crtc_commit, causing a use-after-free during a later drm_atomic_commit(). The fix uses __drm_atomic_helper_duplicate_plane_state() to clone the base state correctly.

Likely exposure

Exposure is limited to Linux systems using the Atmel HLCDC DRM driver and a vulnerable kernel build. Triggering requires local, low-privileged access and interaction with the graphics device while another DRM client remains attached. The bundle’s flattened version list does not clearly establish exact branch boundaries, so build-level verification is necessary.

Exploitation context

The failure was observed when closing and reopening the device node while another DRM client, such as fbdev, remained attached. CVSS characterizes exploitation as local, low complexity, low privilege, and requiring no user interaction. The bundle says this CVE is not in KEV and provides no evidence of exploitation in the wild.

Researcher notes

The defect is stale commit-pointer retention caused by incomplete plane-state duplication. The supplied trace shows allocation in drm_atomic_helper_setup_commit(), release in drm_atomic_helper_commit_hw_done(), and later memory corruption. Multiple stable-tree commits are supplied, suggesting branch-specific backports; map the deployed kernel tree to its applicable commit before concluding vulnerability status.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable linked stable fix.
  • Check distribution or device-vendor guidance for exact fixed builds and backports.
  • Until patched, restrict untrusted local access to affected DRM device nodes where operationally feasible.
  • Prioritize embedded or appliance systems confirmed to use the Atmel HLCDC driver.

Validation and detection

  • Inventory kernel builds and determine whether the Atmel HLCDC DRM driver is present or active.
  • Confirm the applicable stable fix commit or vendor backport exists in each deployed kernel.
  • Review kernel logs for slab-poison corruption or use-after-free symptoms involving DRM atomic commits.
  • Perform regression testing of device close and reopen behavior with another DRM client attached.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43236 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-43236Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2389fc1305fc1e2cf8b310a75463fefd3058bf48, 2389fc1305fc1e2cf8b310a75463fefd3058bf48, 2389fc1305fc1e2cf8b310a75463fefd3058bf48, 2389fc1305fc1e2cf8b310a75463fefd3058bf48, 2389fc1305fc1e2cf8b310a75463fefd3058bf48, 2389fc1305fc1e2cf8b310a75463fefd3058bf48, 2389fc1305fc1e2cf8b310a75463fefd3058bf48, 2389fc1305fc1e2cf8b310a75463fefd3058bf48unaffected
LinuxLinux4.1, 0, 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.