Answer in brief
CVE-2026-43236 records a High severity (CVSS 7.8) vulnerability in drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=2389fc1305fc1e2cf8b310a75463fefd3058bf48 <fd4a4d0711f48a99b25bcd45e00eef8339eff82d || >=2389fc1305fc1e2cf8b310a75463fefd3058bf48 <6404898af86d986db1dbbe06177c143e40652e49 || >=2389fc1305fc1e2cf8b310a75463fefd3058bf48 <796e77c14c4c1e2cd36473760fb6cc66c695eb47 || >=2389fc1305fc1e2cf8b310a75463fefd3058bf48 <ac2d898da5095d46bd1ff8585fdd753d58ad91e7 || >=2389fc1305fc1e2cf8b310a75463fefd3058bf48 <a205740a7231e967ac77cb731171642901c327af || >=2389fc1305fc1e2cf8b310a75463fefd3058bf48 <7b4d0fab3ff2c00c6d34e1952c9df5129a826aee || >=2389fc1305fc1e2cf8b310a75463fefd3058bf48 <549c6db503dbb85dbff4840830971853feac6625 || >=2389fc1305fc1e2cf8b310a75463fefd3058bf48 <bc847787233277a337788568e90a6ee1557595eb | fd4a4d0711f48a99b25bcd45e00eef8339eff82d, 6404898af86d986db1dbbe06177c143e40652e49, 796e77c14c4c1e2cd36473760fb6cc66c695eb47, ac2d898da5095d46bd1ff8585fdd753d58ad91e7, a205740a7231e967ac77cb731171642901c327af, 7b4d0fab3ff2c00c6d34e1952c9df5129a826aee, 549c6db503dbb85dbff4840830971853feac6625, bc847787233277a337788568e90a6ee1557595eb |
| Linux/Linuxgeneric | 4.1 | Not reported |
Published upstream
May 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying the atmel_hlcdc_plane state structure without properly duplicating the drm_plane_state. In particular, state->commit remained set to the old state commit, which can lead to a use-after-free in the next drm_atomic_commit() call. Fix this by calling __drm_atomic_helper_duplicate_plane_state(), which correctly clones the base drm_plane_state (including the ->commit pointer). It has been seen when closing and re-opening the device node while another DRM client (e.g. fbdev) is still attached: ============================================================================= BUG kmalloc-64 (Not tainted): Poison overwritten ----------------------------------------------------------------------------- 0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0 pid=29 drm_atomic_helper_setup_commit+0x1e8/0x7bc drm_atomic_helper_commit+0x3c/0x15c drm_atomic_commit+0xc0/0xf4 drm_framebuffer_remove+0x4cc/0x5a8 drm_mode_rmfb_work_fn+0x6c/0x80 process_one_work+0x12c/0x2cc worker_thread+0x2a8/0x400 kthread+0xc0/0xdc ret_from_fork+0x14/0x28 Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0 pid=169 drm_atomic_helper_commit_hw_done+0x100/0x150 drm_atomic_helper_commit_tail+0x64/0x8c commit_tail+0x168/0x18c drm_atomic_helper_commit+0x138/0x15c drm_atomic_commit+0xc0/0xf4 drm_atomic_helper_set_config+0x84/0xb8 drm_mode_setcrtc+0x32c/0x810 drm_ioctl+0x20c/0x488 sys_ioctl+0x14c/0xc20 ret_fast_syscall+0x0/0x54 Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0 flags=0x200(workingset|zone=0) Object 0xc611b340 @offset=832 fp=0xc611b7c0
Quoted source text, attributed separately from HOL analysis.