CVE-2026-68236: drm/amd/display: set new_stream to NULL after release
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: set newstream to NULL after release
In dmupdatecrtcstate(), the skipmodeset path releases newstream via dcstreamrelease() but does not set the pointer to NULL.
If a later error (e.g., color management failure) triggers the fail label, the error path calls dcstreamrelease() again on the same dangling pointer, causing a double release and potential use-after-free.
Fix this by setting newstream to NULL after the initial release.
(cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In drm/amd/display, set new_stream to NULL immediately after releasing it on the skip_modeset path in dm_update_crtc_state() (after dc_stream_release()), so later error paths do not double-release the same stream.
Linux kernel drm/amd/display new_stream pointer (set to NULL after release) = NULL
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68236?
CVE-2026-68236 has a risk severity rating of 41.
How do I fix CVE-2026-68236?
To fix CVE-2026-68236, ensure that the affected Linux kernel version is updated to include the patch that initializes new_stream to NULL after release.
What components are affected by CVE-2026-68236?
CVE-2026-68236 affects the Linux kernel's AMD display driver in the drm subsystem.
What type of vulnerability is CVE-2026-68236?
CVE-2026-68236 is classified as a Use After Free vulnerability.
When was CVE-2026-68236 published?
CVE-2026-68236 was published on August 10, 2026.