CVE-2023-54091

drm/client: Fix memory leak in drm_client_target_cloned

published December 24, 2025

CVSS
—
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/client: Fix memory leak in drm_client_target_cloned

dmt_mode is allocated and never freed in this function.

It was found with the ast driver, but most drivers using generic fbdev

setup are probably affected.

This fixes the following kmemleak report:

backtrace:

[<00000000b391296d>] drm_mode_duplicate+0x45/0x220 [drm]

[<00000000e45bb5b3>] drm_client_target_cloned.constprop.0+0x27b/0x480 [drm]

[<00000000ed2d3a37>] drm_client_modeset_probe+0x6bd/0xf50 [drm]

[<0000000010e5cc9d>] __drm_fb_helper_initial_config_and_unlock+0xb4/0x2c0 [drm_kms_helper]

[<00000000909f82ca>] drm_fbdev_client_hotplug+0x2bc/0x4d0 [drm_kms_helper]

[<00000000063a69aa>] drm_client_register+0x169/0x240 [drm]

[<00000000a8c61525>] ast_pci_probe+0x142/0x190 [ast]

[<00000000987f19bb>] local_pci_probe+0xdc/0x180

[<000000004fca231b>] work_for_cpu_fn+0x4e/0xa0

[<0000000000b85301>] process_one_work+0x8b7/0x1540

[<000000003375b17c>] worker_thread+0x70a/0xed0

[<00000000b0d43cd9>] kthread+0x29f/0x340

[<000000008d770833>] ret_from_fork+0x1f/0x30

unreferenced object 0xff11000333089a00 (size 128):

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00257 · 16.4th percentile
Published
2025-12-24T13:06Z
EPSS history
Timeline
  • 24 DEC 13:06Z
    drm/client: Fix memory leak in drm_client_target_cloned
    cvelistv5