Executive brief
A bug in the Intel graphics driver (i915) within the Linux kernel could allow a local attacker to cause a system crash or potential privilege escalation. The vulnerability exists in display mode setting code that manages color correction lookup tables; under certain error conditions, the same memory region can be freed twice, corrupting kernel memory and potentially enabling code execution.
Technical details
This is a use-after-free vulnerability in the i915 DRM display driver's CRTC (Cathode Ray Tube Controller) state management code. The function intel_crtc_put_color_blobs() drops references to color lookup table blobs but fails to clear the corresponding pointers. When intel_crtc_prepare_cleared_state() encounters an error (e.g., -EDEADLK) during DP tunnel state lookup after freeing old CRTC hardware state, it returns prematurely without completing state preparation. The atomic core then clears the failed state and calls intel_crtc_free_hw_state() again, causing the same blob references to be dropped a second time. This double-free corrupts kernel memory. A local attacker can trigger this via graphics mode setting operations to cause a kernel panic or potentially execute arbitrary code. The fix clears all blob pointers after dropping their references, making repeated cleanup operations safe.
Affected products
- Linux Linux kernel multiple versions across linux-5.x, linux-6.x, and linux-7.x
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-06-12: patched: Upstream commit authored (Guangshuo Li)
- 2026-07-24: patched: Merged into stable kernel trees