// For flags

CVE-2026-23227

drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free Exynos Virtual Display driver performs memory alloc/free operations
without lock protection, which easily causes concurrency problem. For example, use-after-free can occur in race scenario like this:
``` CPU0 CPU1 CPU2 ---- ---- ---- vidi_connection_ioctl() if (vidi->connection) // true drm_edid = drm_edid_alloc(); // alloc drm_edid ... ctx->raw_edid = drm_edid; ... drm_mode_getconnector() drm_helper_probe_single_connector_modes() vidi_get_modes() if (ctx->raw_edid) // true drm_edid_dup(ctx->raw_edid); if (!drm_edid) // false ... vidi_connection_ioctl() if (vidi->connection) // false drm_edid_free(ctx->raw_edid); // free drm_edid ... drm_edid_alloc(drm_edid->edid) kmemdup(edid); // UAF!! ...
``` To prevent these vulns, at least in vidi_context, member variables related
to memory alloc/free should be protected with ctx->lock.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2026-01-13 CVE Reserved
  • 2026-02-18 CVE Published
  • 2026-03-22 EPSS Updated
  • 2026-04-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 3.6 < 6.1.167
Search vendor "Linux" for product "Linux Kernel" and version " >= 3.6 < 6.1.167"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 3.6 < 6.6.130
Search vendor "Linux" for product "Linux Kernel" and version " >= 3.6 < 6.6.130"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 3.6 < 6.12.77
Search vendor "Linux" for product "Linux Kernel" and version " >= 3.6 < 6.12.77"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 3.6 < 6.18.11
Search vendor "Linux" for product "Linux Kernel" and version " >= 3.6 < 6.18.11"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 3.6 < 6.19.1
Search vendor "Linux" for product "Linux Kernel" and version " >= 3.6 < 6.19.1"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 3.6 < 7.0-rc1
Search vendor "Linux" for product "Linux Kernel" and version " >= 3.6 < 7.0-rc1"
en
Affected