Cloudanix VulnDB

CVE-2026-68236

None

CVSS

—

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A graphics driver bug in the Linux kernel can let a local user cause memory corruption that may crash the system or allow unauthorized code execution.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Double dc_stream_release() call on the same pointer in dm_update_crtc_state() error path after skip_modeset release without NULL assignment, leading to use-after-free.

Why it matters to the business

Kernel instability or potential local privilege escalation affecting graphics workloads on AMD hardware; low exploitability reduces immediate operational risk.

How an attack unfolds

An attacker with local access crafts display state transitions that hit the skip_modeset release followed by a color-management or similar failure, triggering the fail path to reuse the dangling pointer.

How to fix it

Apply the upstream fix that sets new_stream to NULL immediately after dc_stream_release in the skip_modeset path; rebuild and deploy updated kernel packages.

How to confirm the fix worked

Confirm kernel source contains the NULL assignment after dc_stream_release in dm_update_crtc_state and verify the fix commit is present; test error paths in display state updates.

Typical attack path

  1. Obtain local unprivileged access on affected Linux system
  2. Trigger dm_update_crtc_state via display or modeset operations
  3. Force skip_modeset release of new_stream
  4. Induce subsequent error path that invokes dc_stream_release again
  5. Exploit resulting use-after-free for memory corruption or crash

How to detect it

Review kernel logs for repeated dc_stream_release calls or use-after-free warnings in amdgpu/drm paths; inspect crash dumps for double-release patterns in display state handling.

What your security team should do

  • Prioritize kernel updates for systems with AMD display hardware
  • Monitor for future EPSS increases or KEV inclusion
  • Restrict unprivileged local access where feasible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the pointer to NULL. If a later error (e.g., color management failure) triggers the fail label, the error path calls dc_stream_release() again on the same dangling pointer, causing a double release and potential use-after-free. Fix this by setting new_stream to NULL after the initial release. (cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)

Affected packages

Ecosystem Package Introduced Fixed