CVE-2026-23039

drm/gud: fix NULL fb and crtc dereferences on USB disconnect

published January 31, 2026

CVSS
—
EPSS
0%
Percentile
11.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/gud: fix NULL fb and crtc dereferences on USB disconnect

On disconnect drm_atomic_helper_disable_all() is called which

sets both the fb and crtc for a plane to NULL before invoking a commit.

This causes a kernel oops on every display disconnect.

Add guards for those dereferences.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00219 · 11.7th percentile
Published
2026-01-31T11:42Z
EPSS history
Timeline
  • 31 JAN 11:42Z
    drm/gud: fix NULL fb and crtc dereferences on USB disconnect
    cvelistv5