In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: set new_stream to NULL after release

In dm_update_crtc_state(), the skip_modeset path releases new_stream
via dc_stream_release() but does not set the pointer to NULL.

If a later error (e.g., color management failure) triggers the fail
label, the error path calls dc_stream_release() again on the same
dangling pointer, causing a double release and potential use-after-free.

Fix this by setting new_stream to NULL after the initial release.

(cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
9b690ef3c70422cdcd0cf912db33f2c92ef4a53f affected < ba8bf1dcbb44773e7a0fd13b42925c644e0d5e76
9b690ef3c70422cdcd0cf912db33f2c92ef4a53f affected < 5182e442e61397d446c36995b8f5676942d35b82
9b690ef3c70422cdcd0cf912db33f2c92ef4a53f affected < 679f23f0a3606afcef1ffabd72222f00a54ad9e3
9b690ef3c70422cdcd0cf912db33f2c92ef4a53f affected < 0676fecbb5242aa22c057e78326d6d6041db034c
9b690ef3c70422cdcd0cf912db33f2c92ef4a53f affected < 9fa26b9eed6195bf840f39ac183b9a6237548755
Linux Linux affected
Version Status Constraints
4.15 affected —
0 unaffected < 4.15
6.6.148 unaffected ≤ 6.6.*
6.12.101 unaffected ≤ 6.12.*
6.18.42 unaffected ≤ 6.18.*
7.1.6 unaffected ≤ 7.1.*
7.2-rc4 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0676fecbb5242aa22c057e78326d6d6041db034c cve-icon
https://git.kernel.org/stable/c/5182e442e61397d446c36995b8f5676942d35b82 cve-icon
https://git.kernel.org/stable/c/679f23f0a3606afcef1ffabd72222f00a54ad9e3 cve-icon
https://git.kernel.org/stable/c/9fa26b9eed6195bf840f39ac183b9a6237548755 cve-icon
https://git.kernel.org/stable/c/ba8bf1dcbb44773e7a0fd13b42925c644e0d5e76 cve-icon
History

Mon, 10 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Mon, 10 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the pointer to NULL. If a later error (e.g., color management failure) triggers the fail label, the error path calls dc_stream_release() again on the same dangling pointer, causing a double release and potential use-after-free. Fix this by setting new_stream to NULL after the initial release. (cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)
Title drm/amd/display: set new_stream to NULL after release
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-10T12:01:01.114Z

Reserved: 2026-07-30T09:28:09.376Z

Link: CVE-2026-68236

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T15:00:03Z

Weaknesses