CVE-2026-45956: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45956 Overview

CVE-2026-45956 is a Linux kernel vulnerability in the drm/exynos virtual display (vidi) driver. The flaw exists in vidi_connection_ioctl(), which incorrectly retrieves driver_data from drm_dev->dev to obtain a struct vidi_context pointer. Because drm_dev->dev is the exynos-drm master device, the returned driver_data does not point to the vidi component device, but to an unrelated device structure.

Critical Impact
The incorrect pointer can trigger null pointer dereferences, garbage value reads, out-of-bounds access, and use-after-free conditions in kernel context.

Affected Products

Linux kernel branches containing the drm/exynos vidi driver
Distributions shipping vulnerable stable kernels prior to the referenced fix commits
Embedded and Exynos-based systems using the Direct Rendering Manager (DRM) subsystem

Discovery Timeline

2026-05-27 - CVE-2026-45956 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45956

Vulnerability Analysis

The bug resides in the Exynos DRM virtual display driver (drivers/gpu/drm/exynos/exynos_drm_vidi.c). The vidi_connection_ioctl() handler obtains a vidi_context pointer by dereferencing driver_data on the master DRM device rather than on the vidi component device. The master device's driver_data belongs to a different driver and has a different layout.

When userspace invokes the vidi connection ioctl, the kernel interprets unrelated memory as a vidi_context structure. Depending on the actual contents at that address, the kernel may dereference NULL fields, read garbage, or follow attacker-influenced pointers leading to out-of-bounds reads, writes, or use-after-free behavior in kernel space.

Root Cause

The root cause is incorrect context resolution. The vidi_dev pointer was never tracked in the shared exynos_drm_private structure, so the ioctl handler used the wrong device. The fix stores the vidi device pointer in exynos_drm_private->vidi_dev during bind and clears it during unbind, allowing the ioctl handler to look up the correct vidi_context.

Attack Vector

A local user with access to the DRM device node can issue the vidi connection ioctl to trigger the faulty lookup. The vulnerability requires local access to the affected DRM character device and does not require elevated privileges beyond those needed to open the device node. Successful triggering can cause kernel crashes (denial of service) or memory corruption that may be leveraged for privilege escalation.

No verified proof-of-concept code is available. The vulnerability mechanism is described in the upstream kernel commits referenced below.

Detection Methods for CVE-2026-45956

Indicators of Compromise

Unexpected kernel oops or panic messages referencing vidi_connection_ioctl or exynos_drm in dmesg and /var/log/kern.log
KASAN reports indicating use-after-free, out-of-bounds access, or null pointer dereference originating in the Exynos DRM vidi path
Repeated process crashes when interacting with /dev/dri/card* on Exynos-based platforms

Detection Strategies

Inventory running kernel versions across Linux fleets and compare against the patched stable releases listed in the kernel.org references
Audit which systems load the exynos_drm module using lsmod or /proc/modules to scope exposure
Monitor for unprivileged processes issuing DRM ioctls against the vidi connection interface

Monitoring Recommendations

Enable kernel auditing (auditd) for ioctl calls on DRM device nodes on Exynos-based hosts
Forward dmesg and kernel ring buffer events to a centralized log platform for crash and KASAN signal analysis
Track process behavior on systems exposing /dev/dri/* to identify anomalous ioctl patterns from non-graphical workloads

How to Mitigate CVE-2026-45956

Immediate Actions Required

Update to a Linux stable kernel that includes the fix commits referenced by kernel.org for this CVE
Restrict access to /dev/dri/* device nodes to trusted users and graphics group members only
Unload the exynos_drm module on systems that do not require Exynos DRM functionality

Patch Information

The upstream fix stores the vidi device pointer in exynos_drm_private->vidi_dev during bind and unbind, then reads it from exynos_drm_private inside the ioctl handler. The patch is available across multiple stable branches:

Workarounds

Blacklist the exynos_drm kernel module on systems where Exynos display functionality is not required
Tighten permissions on DRM device nodes so only authenticated graphics users can issue ioctls
Apply distribution vendor backports as soon as they are published for long-term-support kernels

bash

# Configuration example: blacklist the exynos_drm module
echo "blacklist exynos_drm" | sudo tee /etc/modprobe.d/blacklist-exynos-drm.conf
sudo depmod -a
sudo update-initramfs -u