CVE-2026-43236

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release

The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying

the atmel_hlcdc_plane state structure without properly duplicating the

drm_plane_state. In particular, state->commit remained set to the old

state commit, which can lead to a use-after-free in the next

drm_atomic_commit() call.

Fix this by calling

__drm_atomic_helper_duplicate_plane_state(), which correctly clones

the base drm_plane_state (including the ->commit pointer).

It has been seen when closing and re-opening the device node while

another DRM client (e.g. fbdev) is still attached:

=============================================================================

BUG kmalloc-64 (Not tainted): Poison overwritten

-----------------------------------------------------------------------------

0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b

FIX kmalloc-64: Restorin

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References