CVE-2026-43236

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release<br /> <br /> The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying<br /> the atmel_hlcdc_plane state structure without properly duplicating the<br /> drm_plane_state. In particular, state-&gt;commit remained set to the old<br /> state commit, which can lead to a use-after-free in the next<br /> drm_atomic_commit() call.<br /> <br /> Fix this by calling<br /> __drm_atomic_helper_duplicate_plane_state(), which correctly clones<br /> the base drm_plane_state (including the -&gt;commit pointer).<br /> <br /> It has been seen when closing and re-opening the device node while<br /> another DRM client (e.g. fbdev) is still attached:<br /> <br /> =============================================================================<br /> BUG kmalloc-64 (Not tainted): Poison overwritten<br /> -----------------------------------------------------------------------------<br /> <br /> 0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b<br /> FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b<br /> Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0<br /> pid=29<br /> drm_atomic_helper_setup_commit+0x1e8/0x7bc<br /> drm_atomic_helper_commit+0x3c/0x15c<br /> drm_atomic_commit+0xc0/0xf4<br /> drm_framebuffer_remove+0x4cc/0x5a8<br /> drm_mode_rmfb_work_fn+0x6c/0x80<br /> process_one_work+0x12c/0x2cc<br /> worker_thread+0x2a8/0x400<br /> kthread+0xc0/0xdc<br /> ret_from_fork+0x14/0x28<br /> Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0<br /> pid=169<br /> drm_atomic_helper_commit_hw_done+0x100/0x150<br /> drm_atomic_helper_commit_tail+0x64/0x8c<br /> commit_tail+0x168/0x18c<br /> drm_atomic_helper_commit+0x138/0x15c<br /> drm_atomic_commit+0xc0/0xf4<br /> drm_atomic_helper_set_config+0x84/0xb8<br /> drm_mode_setcrtc+0x32c/0x810<br /> drm_ioctl+0x20c/0x488<br /> sys_ioctl+0x14c/0xc20<br /> ret_fast_syscall+0x0/0x54<br /> Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0<br /> flags=0x200(workingset|zone=0)<br /> Object 0xc611b340 @offset=832 fp=0xc611b7c0