CVE-2026-23227

drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free

Published Feb 18, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free

Exynos Virtual Display driver performs memory alloc/free operations
without lock protection, which easily causes concurrency problem.

For example, use-after-free can occur in race scenario like this:
```
CPU0 CPU1 CPU2
---- ---- ----
vidi_connection_ioctl()
if (vidi->connection) // true
drm_edid = drm_edid_alloc(); // alloc drm_edid
...
ctx->raw_edid = drm_edid;
...
drm_mode_getconnector()
drm_helper_probe_single_connector_modes()
vidi_get_modes()
if (ctx->raw_edid) // true
drm_edid_dup(ctx->raw_edid);
if (!drm_edid) // false
...
vidi_connection_ioctl()
if (vidi->connection) // false
drm_edid_free(ctx->raw_edid); // free drm_edid
...
drm_edid_alloc(drm_edid->edid)
kmemdup(edid); // UAF!!
...
```

To prevent these vulns, at least in vidi_context, member variables related
to memory alloc/free should be protected with ctx->lock.

Analysis

Technical impact

A race condition in the Exynos Virtual Display driver results in memory allocation and deallocation operations being performed without proper lock protection. The kernel can free an object that another thread is still accessing, triggering a use‑after‑free scenario. This vulnerability can corrupt memory, potentially allowing an attacker to execute arbitrary code or crash the system. The weakness is a classic use‑after‑free flaw (CWE‑416).

Affected Systems

Any system running a Linux kernel that incorporates the Exynos Virtual Display driver is affected. The vulnerability is present in all versions of the Linux kernel up to the point where the patch is applied, regardless of distribution vendor. The specific impacted component is the DRM/exynos vidi module; therefore all Linux kernels that compile with the Exynos Virtual Display driver are at risk.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity, and the EPSS score of less than 1 % suggests that exploitation is currently unlikely, consistent with the fact that the vulnerability requires a race condition. The vulnerability is not yet listed in CISA’s KEV catalog. The primary attack vector is local, requiring concurrent use of the driver by two threads, which typically means a privileged or root user or a malicious user exploiting a privileged interface. While not immediately exploitable in a publicly shared environment, an attacker with local access could trigger the flaw to corrupt memory or gain arbitrary code execution.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d3b62dbfc7b9bb013926f56db79b60f6c18c392f`	affected	< 56966a4cfa925ec24edb68ab652a740a7abe2c4d
`d3b62dbfc7b9bb013926f56db79b60f6c18c392f`	affected	< 9e1ef9396a1899925911b1729cb65665420268df
`d3b62dbfc7b9bb013926f56db79b60f6c18c392f`	affected	< 92dd1f38d7db75374dcdaf54f1d79d67bffd54e5
`d3b62dbfc7b9bb013926f56db79b60f6c18c392f`	affected	< 1b24d3e8792bcc050c70e8e0dea6b49c4fc63b13
`d3b62dbfc7b9bb013926f56db79b60f6c18c392f`	affected	< abfdf449fb3d7b42e85a1ad1c8694b768b1582f4
`d3b62dbfc7b9bb013926f56db79b60f6c18c392f`	affected	< 60b75407c172e1f341a8a5097c5cbc97dbbdd893
`d3b62dbfc7b9bb013926f56db79b60f6c18c392f`	affected	< 0cd2c155740dbd00868ac5a8ae5d14cd6b9ed385
`d3b62dbfc7b9bb013926f56db79b60f6c18c392f`	affected	< 52b330799e2d6f825ae2bb74662ec1b10eb954bb

Linux

affected

Version	Status	Constraints
`3.6`	affected	—
`0`	unaffected	< 3.6
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.77`	unaffected	≤ 6.12.*
`6.18.11`	unaffected	≤ 6.18.*
`6.19.1`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,60b75407c172e1f341a8a5097c5cbc97dbbdd893)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0cd2c155740dbd00868ac5a8ae5d14cd6b9ed385)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[6.18.11,7.0.0)`	unaffected	semver	—
`[6.19.1,7.0.0)`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a kernel version that includes the patch fixing the use of ctx->lock for memory operations in the Exynos Virtual Display driver
If an upgrade is not immediately possible, disable the Exynos Virtual Display driver or restrict its interfaces to trusted users only
Monitor kernel logs for drm_edid or memory allocation errors and consider applying kernel runtime lock debugging tools to detect concurrency issues

Generated by OpenCVE AI on April 15, 2026 at 15:47 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DLA	DLA-4606-1	linux security update
Debian DSA	DSA-6238-1	linux security update
Debian DSA	DSA-6243-1	linux security update
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.170% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0cd2c155740dbd00868ac5a8ae5d14cd6b9ed385
https://git.kernel.org/stable/c/1b24d3e8792bcc050c70e8e0dea6b49c4fc63b13
https://git.kernel.org/stable/c/52b330799e2d6f825ae2bb74662ec1b10eb954bb
https://git.kernel.org/stable/c/56966a4cfa925ec24edb68ab652a740a7abe2c4d
https://git.kernel.org/stable/c/60b75407c172e1f341a8a5097c5cbc97dbbdd893
https://git.kernel.org/stable/c/92dd1f38d7db75374dcdaf54f1d79d67bffd54e5
https://git.kernel.org/stable/c/9e1ef9396a1899925911b1729cb65665420268df
https://git.kernel.org/stable/c/abfdf449fb3d7b42e85a1ad1c8694b768b1582f4
https://lore.kernel.org/linux-cve-announce/2026021807-CVE-2026-23227-6986@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23227
https://www.cve.org/CVERecord?id=CVE-2026-23227

History

Apr 18, 2026 9:15 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/56966a4cfa925ec24edb68ab652a740a7abe2c4d https://git.kernel.org/stable/c/9e1ef9396a1899925911b1729cb65665420268df

Mar 25, 2026 10:45 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/1b24d3e8792bcc050c70e8e0dea6b49c4fc63b13 https://git.kernel.org/stable/c/92dd1f38d7db75374dcdaf54f1d79d67bffd54e5

Mar 18, 2026 2:45 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Mar 13, 2026 5:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/abfdf449fb3d7b42e85a1ad1c8694b768b1582f4

Feb 23, 2026 3:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/52b330799e2d6f825ae2bb74662ec1b10eb954bb

Feb 19, 2026 12:15 AM Added references View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021807-CVE-2026-23227-6986@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23227 https://www.cve.org/CVERecord?id=CVE-2026-23227

Feb 18, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free Exynos Virtual Display driver performs memory alloc/free operations without lock protection, which easily causes concurrency problem. For example, use-after-free can occur in race scenario like this: ``` CPU0 CPU1 CPU2 ---- ---- ---- vidi_connection_ioctl() if (vidi->connection) // true drm_edid = drm_edid_alloc(); // alloc drm_edid ... ctx->raw_edid = drm_edid; ... drm_mode_getconnector() drm_helper_probe_single_connector_modes() vidi_get_modes() if (ctx->raw_edid) // true drm_edid_dup(ctx->raw_edid); if (!drm_edid) // false ... vidi_connection_ioctl() if (vidi->connection) // false drm_edid_free(ctx->raw_edid); // free drm_edid ... drm_edid_alloc(drm_edid->edid) kmemdup(edid); // UAF!! ... ``` To prevent these vulns, at least in vidi_context, member variables related to memory alloc/free should be protected with ctx->lock.
Title		drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0cd2c155740dbd00868ac5a8ae5d14cd6b9ed385 https://git.kernel.org/stable/c/60b75407c172e1f341a8a5097c5cbc97dbbdd893