CyberSecBulletin
CVE-2026-43236NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-43236 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions fd4a4d0711f48a99b25bcd45e00eef8339eff82d, 6404898af86d986db1dbbe06177c143e40652e49, 796e77c14c4c1e2cd36473760fb6cc66c695eb47 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.14% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to fd4a4d0711f48a99b25bcd45e00eef8339eff82d or 6404898af86d986db1dbbe06177c143e40652e49 or 796e77c14c4c1e2cd36473760fb6cc66c695eb47 or ac2d898da5095d46bd1ff8585fdd753d58ad91e7, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.252 or 5.15.202 or 6.1.165 or 6.6.128, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux2389fc1305fc1e2cf8b310a75463fefd3058bf48 up to, but not including, fd4a4d0711f48a99b25bcd45e00eef8339eff82d; 2389fc1305fc1e2cf8b310a75463fefd3058bf48 up to, but not including, 6404898af86d986db1dbbe06177c143e40652e49; 2389fc1305fc1e2cf8b310a75463fefd3058bf48 up to, but not including, 796e77c14c4c1e2cd36473760fb6cc66c695eb47; 2389fc1305fc1e2cf8b310a75463fefd3058bf48 up to, but not including, ac2d898da5095d46bd1ff8585fdd753d58ad91e7; 2389fc1305fc1e2cf8b310a75463fefd3058bf48 up to, but not including, a205740a7231e967ac77cb731171642901c327af; 2389fc1305fc1e2cf8b310a75463fefd3058bf48 up to, but not including, 7b4d0fab3ff2c00c6d34e1952c9df5129a826aee; 2389fc1305fc1e2cf8b310a75463fefd3058bf48 up to, but not including, 549c6db503dbb85dbff4840830971853feac6625; 2389fc1305fc1e2cf8b310a75463fefd3058bf48 up to, but not including, bc847787233277a337788568e90a6ee1557595eb; and 1 more rangesfd4a4d0711f48a99b25bcd45e00eef8339eff82d, 6404898af86d986db1dbbe06177c143e40652e49, 796e77c14c4c1e2cd36473760fb6cc66c695eb47, ac2d898da5095d46bd1ff8585fdd753d58ad91e7, a205740a7231e967ac77cb731171642901c327af, 7b4d0fab3ff2c00c6d34e1952c9df5129a826aee
LinuxLinux Kernel4.1 up to, but not including, 5.10.252; 5.11 up to, but not including, 5.15.202; 5.16 up to, but not including, 6.1.165; 6.2 up to, but not including, 6.6.128; 6.7 up to, but not including, 6.12.75; 6.13 up to, but not including, 6.18.16; 6.19 up to, but not including, 6.19.65.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying the atmel_hlcdc_plane state structure without properly duplicating the drm_plane_state. In particular, state->commit remained set to the old state commit, which can lead to a use-after-free in the next drm_atomic_commit() call. Fix this by calling __drm_atomic_helper_duplicate_plane_state(), which correctly clones the base drm_plane_state (including the ->commit pointer). It has been seen when closing and re-opening the device node while another DRM client (e.g. fbdev) is still attached: ============================================================================= BUG kmalloc-64 (Not tainted): Poison overwritten ----------------------------------------------------------------------------- 0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0 pid=29 drm_atomic_helper_setup_commit+0x1e8/0x7bc drm_atomic_helper_commit+0x3c/0x15c drm_atomic_commit+0xc0/0xf4 drm_framebuffer_remove+0x4cc/0x5a8 drm_mode_rmfb_work_fn+0x6c/0x80 process_one_work+0x12c/0x2cc worker_thread+0x2a8/0x400 kthread+0xc0/0xdc ret_from_fork+0x14/0x28 Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0 pid=169 drm_atomic_helper_commit_hw_done+0x100/0x150 drm_atomic_helper_commit_tail+0x64/0x8c commit_tail+0x168/0x18c drm_atomic_helper_commit+0x138/0x15c drm_atomic_commit+0xc0/0xf4 drm_atomic_helper_set_config+0x84/0xb8 drm_mode_setcrtc+0x32c/0x810 drm_ioctl+0x20c/0x488 sys_ioctl+0x14c/0xc20 ret_fast_syscall+0x0/0x54 Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0 flags=0x200(workingset|zone=0) Object 0xc611b340 @offset=832 fp=0xc611b7c0

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.