CVE-2026-43269

drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback

MEDIUM

5.5

CVSS Score

Published: May 6, 2026 at 11:28 AM UTC

Updated: June 17, 2026 at 10:49 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback After several commits, the slab memory increases. Some drm_crtc_commit objects are not freed. The atomic_destroy_state callback only put the framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function to put all the objects that are no longer needed. It has been seen after hours of usage of a graphics application or using kmemleak: unreferenced object 0xc63a6580 (size 64): comm "egt_basic", pid 171, jiffies 4294940784 hex dump (first 32 bytes): 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:. 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:. backtrace (crc c25aa925): kmemleak_alloc+0x34/0x3c __kmalloc_cache_noprof+0x150/0x1a4 drm_atomic_helper_setup_commit+0x1e8/0x7bc drm_atomic_helper_commit+0x3c/0x15c drm_atomic_commit+0xc0/0xf4 drm_atomic_helper_set_config+0x84/0xb8 drm_mode_setcrtc+0x32c/0x810 drm_ioctl+0x20c/0x488 sys_ioctl+0x14c/0xc20 ret_fast_syscall+0x0/0x54

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

4.1 ≤ v < 5.10.2524.1 ≤ v < 5.15.2024.1 ≤ v < 6.1.1654.1 ≤ v < 6.12.754.1 ≤ v < 6.18.164.1 ≤ v < 6.19.64.1 ≤ v < 6.6.1284.1 ≤ v < 7.05.11 ≤ v < 5.15.2025.16 ≤ v < 6.1.1656.13 ≤ v < 6.18.166.19 ≤ v < 6.19.66.2 ≤ v < 6.6.1286.7 ≤ v < 6.12.752389fc1305fc1e2cf8b310a75463fefd3058bf484.1

Vendor states this is fixed in 082271e364a3205598c2e4e6233a9f49ce7941cf (fixed)

Vendor states this is fixed in 25e832a7830740e72103eb0b527680a4b64bbcb3 (fixed)

Vendor states this is fixed in 3e64e78f4a70e3f6ac8fe5a7071f08ffd25a2489 (fixed)

Vendor states this is fixed in 5718d98976ad6b9700e5a6afec67fc47a8a92580 (fixed)

Vendor states this is fixed in 57fa3487acfa3467405f8506b94682abd96e7393 (fixed)

Vendor states this is fixed in 6d4e91ab97fda64e8cf9c8881cc3b4da026bd849 (fixed)

Vendor states this is fixed in ec40702029b08ee8d5f5b03303d64a10e74a957b (fixed)

Vendor states this is fixed in f12352471061df83a36edf54bbb16284793284e4 (fixed)

Vendor states this is fixed in 4.1 (unaffected)

Vendor states this is fixed in 5.10.252 (unaffected)

Vendor states this is fixed in 5.15.202 (unaffected)

Vendor states this is fixed in 6.1.165 (unaffected)