CVE-2026-53378

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/colorop: Fix blob property reference tracking in state lifecycle<br /> <br /> The colorop state blob property handling had memory leaks during state<br /> duplication, destruction, and reset operations. The implementation<br /> failed to follow the established pattern from drm_crtc&amp;#39;s handling of<br /> DEGAMMA/GAMMA blob properties.<br /> <br /> Issues fixed:<br /> - drm_colorop_atomic_destroy_state() was freeing state memory without<br /> releasing the blob reference, causing a leak<br /> - drm_colorop_reset() was directly freeing old state with kfree()<br /> instead of properly destroying it, leaking blob references<br /> - drm_colorop_cleanup() had duplicate blob cleanup code<br /> <br /> Changes:<br /> - Add __drm_atomic_helper_colorop_destroy_state() helper to properly<br /> release blob references before freeing state memory<br /> - Update drm_colorop_atomic_destroy_state() to call the helper<br /> - Fix drm_colorop_reset() to use drm_colorop_atomic_destroy_state()<br /> for proper cleanup of old state<br /> - Simplify drm_colorop_cleanup() to use the common destruction path<br /> <br /> This matches the well-tested pattern used by drm_crtc since 2016 and<br /> ensures proper reference counting throughout the state lifecycle.<br /> <br /> Co-developed by Claude Sonnet 4.5.