CVE-2026-23227
drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free Exynos Virtual Display driver performs memory alloc/free operations
without lock protection, which easily causes concurrency problem. For example, use-after-free can occur in race scenario like this:
``` CPU0 CPU1 CPU2 ---- ---- ---- vidi_connection_ioctl() if (vidi->connection) // true drm_edid = drm_edid_alloc(); // alloc drm_edid ... ctx->raw_edid = drm_edid; ... drm_mode_getconnector() drm_helper_probe_single_connector_modes() vidi_get_modes() if (ctx->raw_edid) // true drm_edid_dup(ctx->raw_edid); if (!drm_edid) // false ... vidi_connection_ioctl() if (vidi->connection) // false drm_edid_free(ctx->raw_edid); // free drm_edid ... drm_edid_alloc(drm_edid->edid) kmemdup(edid); // UAF!! ...
``` To prevent these vulns, at least in vidi_context, member variables related
to memory alloc/free should be protected with ctx->lock.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2026-01-13 CVE Reserved
- 2026-02-18 CVE Published
- 2026-03-22 EPSS Updated
- 2026-04-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| https://git.kernel.org/stable/c/d3b62dbfc7b9bb013926f56db79b60f6c18c392f | Vuln. Introduced |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.6 < 6.1.167 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.6 < 6.1.167" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.6 < 6.6.130 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.6 < 6.6.130" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.6 < 6.12.77 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.6 < 6.12.77" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.6 < 6.18.11 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.6 < 6.18.11" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.6 < 6.19.1 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.6 < 6.19.1" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.6 < 7.0-rc1 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.6 < 7.0-rc1" | en |
Affected
| ||||||
