CVE-2026-72452
drm/i915: clear CRTC color blob pointers after dropping refs
Description
In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intel_crtc_put_color_blobs() drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intel_crtc_prepare_cleared_state(), which frees the old CRTC hw state before calling intel_dp_tunnel_atomic_clear_stream_bw(). The latter can fail while looking up the DP tunnel group state, for example with -EDEADLK. If that happens, the function returns without completing the cleared state preparation. The failed atomic state will then be cleared by the atomic core and intel_crtc_free_hw_state() can be called again for the same state, dropping the same blob references again. Clear the blob pointers after dropping the references so repeated cleanup of the same CRTC hw state is safe. (cherry picked from commit d5005addb5f68e8a0edce249506757bdc9e3d8c8)
INFO
Published Date :
Aug. 15, 2026, 6:22 a.m.
Last Modified :
Aug. 15, 2026, 6:22 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-72452
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Apply the patch that clears CRTC color blob pointers.
- Ensure CRTC state cleanup is robust after reference drops.
- Update the Linux kernel to the patched version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72452.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72452 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72452
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72452 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72452 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '9a6cbb4a5c168e94a69a0cbec572b3738205232b', 'lessThan': '164afa1a3af8e8c91b4a6d5fd7b79a44ec70abf0', 'versionType': 'git'}, {'status': 'affected', 'version': '8581466b827fdf0300a3e2e93900ddefd8240053', 'lessThan': '2024940522ef451098c940ab0b82d647de5e5d9b', 'versionType': 'git'}, {'status': 'affected', 'version': '77fcf58df15edcf3f5b5421f24814fb72796def9', 'lessThan': 'ac554ad943610031a25795d6ef71316f6164c136', 'versionType': 'git'}, {'status': 'affected', 'version': '77fcf58df15edcf3f5b5421f24814fb72796def9', 'lessThan': '31f077088e0faae6be8377741f356dea1b94ba46', 'versionType': 'git'}, {'status': 'affected', 'version': '674fc4a50b667be65c947d81af63a9367deafb5c', 'versionType': 'git'}, {'status': 'affected', 'version': '6.12.80', 'lessThan': '6.12.97', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.18.21', 'lessThan': '6.18.40', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.19.11', 'lessThan': '6.20', 'versionType': 'semver'}], 'programFiles': ['drivers/gpu/drm/i915/display/intel_atomic.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '7.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '7.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/i915/display/intel_atomic.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intel_crtc_put_color_blobs() drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intel_crtc_prepare_cleared_state(), which frees the old CRTC hw state before calling intel_dp_tunnel_atomic_clear_stream_bw(). The latter can fail while looking up the DP tunnel group state, for example with -EDEADLK. If that happens, the function returns without completing the cleared state preparation. The failed atomic state will then be cleared by the atomic core and intel_crtc_free_hw_state() can be called again for the same state, dropping the same blob references again. Clear the blob pointers after dropping the references so repeated cleanup of the same CRTC hw state is safe. (cherry picked from commit d5005addb5f68e8a0edce249506757bdc9e3d8c8) Added Reference https://git.kernel.org/stable/c/164afa1a3af8e8c91b4a6d5fd7b79a44ec70abf0 Added Reference https://git.kernel.org/stable/c/2024940522ef451098c940ab0b82d647de5e5d9b Added Reference https://git.kernel.org/stable/c/31f077088e0faae6be8377741f356dea1b94ba46 Added Reference https://git.kernel.org/stable/c/ac554ad943610031a25795d6ef71316f6164c136