LiveActive security incident?Get immediate response
CVE Record

CVE-2026-45956: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()

In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to obtain a struct vidi_context pointer. However, drm_dev->dev is the exynos-drm master device, and the driver_data contained therein is not the vidi component device, but a completely different device. This can lead to various bugs, ranging from null pointer dereferences and garbage value accesses to, in unlucky cases, out-of-bounds errors, use-after-free errors, and more. To resolve this issue, we need to store/delete the vidi device pointer in exynos_drm_private->vidi_dev during bind/unbind, and then read this exynos_drm_private->vidi_dev within ioctl() to obtain the correct struct vidi_context pointer.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in the Linux Exynos VIDI graphics driver can make the kernel use the wrong device context. A low-privileged local user may be able to trigger crashes or memory corruption, potentially affecting confidentiality, integrity, and availability. The supplied evidence does not establish successful exploitation.

Executive priority

Prioritize multi-user or shared systems where Exynos VIDI is present and untrusted users have local access. Inventory applicability before emergency action because this is not a network-reachable flaw by itself. Patch promptly through supported kernel or distributor channels where exposure is confirmed.

Technical view

vidi_connection_ioctl() obtains driver data from the Exynos DRM master device instead of the VIDI component device. The resulting invalid context can cause null dereferences, garbage accesses, out-of-bounds access, or use-after-free. Stable fixes store the VIDI device in priv->vidi_dev during bind and clear it during unbind.

Likely exposure

Potential exposure is limited to Linux kernels with Exynos DRM VIDI functionality accessible to a low-privileged local user. The supplied version entries do not clearly express affected ranges. Determine exposure by checking the running kernel branch, driver configuration, applicable stable fix, and distributor guidance.

Exploitation context

The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. The supplied record is not in KEV and provides no evidence of active exploitation, a public proof of concept, or demonstrated privilege escalation. Memory corruption makes the potential impact serious, but practical exploitability remains unconfirmed.

Researcher notes

No CWE is assigned. The source describes multiple possible failure modes rather than a proven exploitation primitive. Exact branch boundaries cannot be reconstructed confidently from the supplied version encoding. Review the relevant stable commit and downstream package advisory when mapping a specific kernel build.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable stable fix for your kernel branch.
  • Check distributor guidance because the supplied affected-version boundaries are ambiguous.
  • Restrict untrusted local access to affected DRM device interfaces where operationally feasible.
  • Reboot after updating and confirm the corrected kernel is running.

Validation and detection

  • Identify systems using the Exynos DRM VIDI component.
  • Record each running kernel package, version, configuration, and source revision.
  • Verify the applicable stable fix is present instead of relying solely on version strings.
  • Confirm temporary access restrictions prevent untrusted users from reaching affected DRM interfaces.
  • After remediation, verify the updated kernel is active following reboot.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-45956 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
8Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-45956Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322, cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322, cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322, cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322, cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322, cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322, cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322unaffected
LinuxLinux4.3, 0, 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.18.14, 6.19.4, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.