The atmel_hlcdc driver’s plane state duplication function failed to clone the drm_plane_state correctly, leaving the commit pointer set to a freed object. When drm_atomic_commit is subsequently called, the stale pointer can be dereferenced, triggering a use‑after‑free that corrupts memory and can lead to a kernel panic. This flaw is a classic use‑after‑free vulnerability (CWE‑416) that directly involves the handling of the DRM plane state.

All Linux kernels that include the atmel_hlcdc DRM driver are affected, regardless of distribution. Any system where the driver module is loaded and the atmel‑hlcdc hardware is present can experience the flaw if the driver remains enabled. Affected version information is not disclosed in the CVE data, so all relevant kernel releases containing the driver are potentially impacted.

The CVSS score of 7.8 indicates high severity, the EPSS score of < 1% suggests a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. The likely attack scenario requires local system access with permission to open the DRM device node. A local attacker can trigger the use‑after‑free by closing and reopening the device while another DRM client (e.g., framebuffer) remains attached, potentially causing a kernel crash. The flaw is a CWE‑416 use‑after‑free vulnerability, typically exploitable only from local access and requiring DMA or framebuffer activity. The exploitation likelihood is judged to be very low, given the local nature of the required actions and the absence of public exploit evidence.