CVE-2026-43236: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43236 Overview

CVE-2026-43236 is a use-after-free vulnerability in the Linux kernel's drm/atmel-hlcdc Direct Rendering Manager (DRM) driver. The flaw resides in the atmel_hlcdc_plane_atomic_duplicate_state() callback, which copied the atmel_hlcdc_plane state structure without properly duplicating the underlying drm_plane_state. As a result, the state->commit pointer continued to reference a freed drm_crtc_commit object, causing a use-after-free during subsequent drm_atomic_commit() calls. The Linux kernel maintainers have resolved the issue across multiple stable trees.

Critical Impact
Triggering the bug closes and reopens the DRM device node while another DRM client such as fbdev remains attached, leading to memory corruption in the kernel slab allocator.

Affected Products

Linux kernel builds enabling the drm/atmel-hlcdc driver for Atmel HLCDC display controllers
Embedded platforms based on Microchip/Atmel SoCs using the HLCDC framebuffer pipeline
Distributions shipping pre-patch kernels referenced by the upstream stable commits

Discovery Timeline

2026-05-06 - CVE-2026-43236 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43236

Vulnerability Analysis

The Atmel HLCDC DRM driver implements an atomic modesetting plane abstraction. When the kernel duplicates plane state during atomic commits, it must clone the embedded drm_plane_state, including the ->commit pointer that tracks the in-flight drm_crtc_commit object. The original atmel_hlcdc_plane_atomic_duplicate_state() performed a structure copy that left state->commit pointing at the previous commit. After the previous commit was freed in drm_atomic_helper_commit_hw_done(), the duplicated state retained the stale pointer.

Kernel slab debugging captured the failure as Poison overwritten in the kmalloc-64 cache, with allocation traced to drm_atomic_helper_setup_commit() and the free traced to drm_atomic_helper_commit_hw_done(). This pattern is a textbook use-after-free [CWE-416] in the DRM atomic helper lifecycle.

Root Cause

The driver-specific duplicate callback bypassed the helper __drm_atomic_helper_duplicate_plane_state(), which is responsible for correctly cloning the base drm_plane_state and incrementing the commit reference count. Without that call, reference counting on drm_crtc_commit was incorrect, leaving dangling pointers in subsequent state objects.

Attack Vector

A local user with access to the DRM device node can trigger the condition by closing and reopening /dev/dri/cardX while another DRM client such as fbdev continues to hold the device. The follow-up drm_atomic_commit() dereferences the freed drm_crtc_commit, producing kernel memory corruption that an attacker may shape into denial of service or escalation depending on slab layout.

// No verified proof-of-concept code is published.
// Reproduction requires:
//   1. An active fbdev (or other) DRM client attached to atmel-hlcdc
//   2. A second process opening the DRM node, issuing an atomic
//      modeset (DRM_IOCTL_MODE_SETCRTC), then closing the fd
//   3. A subsequent atomic commit that dereferences the stale
//      drm_plane_state->commit pointer

Detection Methods for CVE-2026-43236

Indicators of Compromise

Kernel log entries reporting BUG kmalloc-64 (Not tainted): Poison overwritten with allocation traces through drm_atomic_helper_setup_commit
KASAN or SLUB debug reports referencing drm_atomic_helper_commit_hw_done as the free site and atmel_hlcdc_plane_atomic_duplicate_state on the use path
Unexpected oops or panics on Atmel HLCDC platforms following DRM_IOCTL_MODE_RMFB or DRM_IOCTL_MODE_SETCRTC activity

Detection Strategies

Enable CONFIG_SLUB_DEBUG and KASAN on test images to surface poison overwrite events on affected hardware
Monitor dmesg for stack frames containing drm_framebuffer_remove, drm_mode_setcrtc, and atmel_hlcdc symbols appearing together near a slab corruption report
Audit running kernels against the upstream fix commits 549c6db, 6404898, 796e77c, 7b4d0fa, a205740, ac2d898, bc84778, and fd4a4d0

Monitoring Recommendations

Forward kernel ring buffer events from embedded Atmel/Microchip devices to a centralized log pipeline for slab-corruption pattern matching
Track DRM ioctl activity (DRM_IOCTL_MODE_SETCRTC, DRM_IOCTL_MODE_RMFB) on systems that should not have multiple display clients
Alert on repeated process crashes accompanied by DRM-related kernel warnings

How to Mitigate CVE-2026-43236

Immediate Actions Required

Upgrade to a Linux stable release that includes one of the referenced atmel-hlcdc fix commits
Inventory devices using Atmel HLCDC display controllers and prioritize patching those running pre-fix kernels
Restrict access to /dev/dri/cardX nodes to trusted local users where feasible

Patch Information

The upstream fix replaces the manual structure copy with __drm_atomic_helper_duplicate_plane_state(), which correctly clones the base drm_plane_state and the ->commit pointer. Backports are available across multiple stable branches via the kernel.org commits 549c6db, 6404898, 796e77c, 7b4d0fa, a205740, ac2d898, bc84778, and fd4a4d0.

Workarounds

Avoid running concurrent DRM clients (such as fbdev and a userspace compositor) on Atmel HLCDC hardware until the patch is deployed
Disable the atmel-hlcdc module on systems that do not require the display pipeline
Tighten device permissions on /dev/dri/* to limit which processes can issue atomic modeset ioctls

bash

# Verify your running kernel includes the atmel-hlcdc fix
uname -r
git -C /usr/src/linux log --oneline | grep -E '549c6db|6404898|796e77c|7b4d0fa|a205740|ac2d898|bc84778|fd4a4d0'

# Restrict DRM device access to the video group
sudo chgrp video /dev/dri/card*
sudo chmod 0660 /dev/dri/card*