TI-2026-50731 Aliases CVE-2026-72452 GHSA-fg7v-qr3p-44mc

drm/i915: clear CRTC color blob pointers after dropping refs

LOW 35Published 2026-08-15 · Updated 2026-10-16

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intel_crtc_put_color_blobs() drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intel_crtc_prepare_cleared_state(), which frees the old CRTC hw state before calling intel_dp_tunnel_atomic_clear_stream_bw(). The latter can fail while looking up the DP tunnel group state, for example with -EDEADLK. If that happens, the function returns without completing the cleared state preparation. The failed atomic state will then be cleared by the atomic core and intel_crtc_free_hw_state() can be called again for the same state, dropping the same blob references again. Clear the blob pointers after dropping the references so repeated cleanup of the same CRTC hw state is safe. (cherry picked from commit d5005addb5f68e8a0edce249506757bdc9e3d8c8)

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00175 7th percentileScored 2026-11-07

Fix Partial Linux (Linux): 6.12.97, 6.18.40, 6.20 +2Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Linux	Linux	6.12.80 to before 6.12.97; 6.18.21 to before 6.18.40; 6.19.11 to before 6.20	6.12.97, 6.18.40, 6.20	Patch available	CNA
Linux	Linux	7.0 and later	6.12.97, 6.18.40, 7.1.5, 7.2	Patch available	CNA

Linux VendorLinux Affected 6.12.80 to before 6.12.97; 6.18.21 to before 6.18.40; 6.19.11 to before 6.20 Fixed in 6.12.97, 6.18.40, 6.20 Patch available CNA
Linux VendorLinux Affected 7.0 and later Fixed in 6.12.97, 6.18.40, 7.1.5, 7.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:o:linux:linux_kernel::::::::	—	—	Linux

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions — — ·Linux

Remediation

Fix · CNA Linux (Linux) Fixed in 6.12.97, 6.18.40, 6.20
Fix · CNA Linux (Linux) Fixed in 6.12.97, 6.18.40, 7.1.5, 7.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 9	Affected	No fix yet

Not affected: 3 products

Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2026-72452
2026-10-03 Alias added: GHSA-fg7v-qr3p-44mc
2026-10-16 CISA SSVC decision points changed
2026-10-29 Affected versions changed · Red Hat
2026-10-30 CVSS score changed · Red Hat

References

Other 4

TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4

See all 21741 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences