CVE-2026-53378: drm/colorop: Fix blob property reference tracking in state lifecycle
In the Linux kernel, the following vulnerability has been resolved:
drm/colorop: Fix blob property reference tracking in state lifecycle
The colorop state blob property handling had memory leaks during state duplication, destruction, and reset operations. The implementation failed to follow the established pattern from drmcrtc's handling of DEGAMMA/GAMMA blob properties.
Issues fixed: - drmcoloropatomicdestroystate() was freeing state memory without releasing the blob reference, causing a leak - drmcoloropreset() was directly freeing old state with kfree() instead of properly destroying it, leaking blob references - drmcoloropcleanup() had duplicate blob cleanup code
Changes: - Add drmatomichelpercoloropdestroystate() helper to properly release blob references before freeing state memory - Update drmcoloropatomicdestroystate() to call the helper - Fix drmcoloropreset() to use drmcoloropatomicdestroystate() for proper cleanup of old state - Simplify drmcoloropcleanup() to use the common destruction path
This matches the well-tested pattern used by drmcrtc since 2016 and ensures proper reference counting throughout the state lifecycle.
Co-developed by Claude Sonnet 4.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update DRM colorop state lifecycle code so drm_colorop_atomic_destroy_state() calls __drm_atomic_helper_colorop_destroy_state(), and ensure blob reference cleanup is done by the helper before freeing state memory; also fix drm_colorop_reset() to use drm_colorop_atomic_destroy_state() and simplify drm_colorop_cleanup() to use the common destruction path to remove duplicate blob cleanup logic.
Linux kernel DRM colorop state lifecycle destruction/reset/cleanup path = implemented via drm_atomic_helper_colorop_destroy_state() and unified destruction helper
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53378?
CVE-2026-53378 has a severity rating of 9, indicating a critical risk.
How do I fix CVE-2026-53378?
To fix CVE-2026-53378, you should update to the latest stable version of the Linux kernel that includes the patch.
What systems are affected by CVE-2026-53378?
CVE-2026-53378 affects systems running vulnerable versions of the Linux kernel that utilize the drm/colorop library.
What type of vulnerability is CVE-2026-53378?
CVE-2026-53378 is related to memory management and reference tracking issues in the colorop state blob property handling.
When was CVE-2026-53378 published?
CVE-2026-53378 was published on July 19, 2026.