{
  "cveId": "CVE-2026-23471",
  "url": "https://patchblox.com/security/cve/CVE-2026-23471",
  "summary": "CVE-2026-23471 is fixed in linux on 1 platform by DEBIAN-CVE-2026-23471 (version 6.19.10-1), released April 3, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  drm: Fix use-after-free on framebuffers and prop...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug  When trying to do a rather aggressive test of igt\u0027s \u0022xe_module_load --r reload\u0022 with a full desktop environment and game running I noticed a few OOPSes when dereferencing freed pointers, related to framebuffers and property blobs after the compositor exits.  Solve this by guarding the freeing in drm_file with drm_dev_enter/exit, and immediately put the references from struct drm_file objects during drm_dev_unplug().  Related warnings for framebuffers on the subtest: [  739.713076] ------------[ cut here ]------------                WARN_ON(!list_empty(\u0026dev-\u003Emode_config.fb_list)) [  739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at drm_mode_config_cleanup\u002B0x30b/0x320 [drm], CPU#12: xe_module_load/13145 .... [  739.713328] Call Trace: [  739.713330]  \u003CTASK\u003E [  739.713335]  ? intel_pmdemand_destroy_state\u002B0x11/0x20 [xe] [  739.713574]  ? intel_atomic_global_obj_cleanup\u002B0xe4/0x1a0 [xe] [  739.713794]  intel_display_driver_remove_noirq\u002B0x51/0xb0 [xe] [  739.714041]  xe_display_fini_early\u002B0x33/0x50 [xe] [  739.714284]  devm_action_release\u002B0xf/0x20 [  739.714294]  devres_release_all\u002B0xad/0xf0 [  739.714301]  device_unbind_cleanup\u002B0x12/0xa0 [  739.714305]  device_release_driver_internal\u002B0x1b7/0x210 [  739.714311]  device_driver_detach\u002B0x14/0x20 [  739.714315]  unbind_store\u002B0xa6/0xb0 [  739.714319]  drv_attr_store\u002B0x21/0x30 [  739.714322]  sysfs_kf_write\u002B0x48/0x60 [  739.714328]  kernfs_fop_write_iter\u002B0x16b/0x240 [  739.714333]  vfs_write\u002B0x266/0x520 [  739.714341]  ksys_write\u002B0x72/0xe0 [  739.714345]  __x64_sys_write\u002B0x19/0x20 [  739.714347]  x64_sys_call\u002B0xa15/0xa30 [  739.714355]  do_syscall_64\u002B0xd8/0xab0 [  739.714361]  entry_SYSCALL_64_after_hwframe\u002B0x4b/0x53  and  [  739.714459] ------------[ cut here ]------------ [  739.714461] xe 0000:67:00.0: [drm] drm_WARN_ON(!list_empty(\u0026fb-\u003Efilp_head)) [  739.714464] WARNING: drivers/gpu/drm/drm_framebuffer.c:833 at drm_framebuffer_free\u002B0x6c/0x90 [drm], CPU#12: xe_module_load/13145 [  739.714715] RIP: 0010:drm_framebuffer_free\u002B0x7a/0x90 [drm] ... [  739.714869] Call Trace: [  739.714871]  \u003CTASK\u003E [  739.714876]  drm_mode_config_cleanup\u002B0x26a/0x320 [drm] [  739.714998]  ? __drm_printfn_seq_file\u002B0x20/0x20 [drm] [  739.715115]  ? drm_mode_config_cleanup\u002B0x207/0x320 [drm] [  739.715235]  intel_display_driver_remove_noirq\u002B0x51/0xb0 [xe] [  739.715576]  xe_display_fini_early\u002B0x33/0x50 [xe] [  739.715821]  devm_action_release\u002B0xf/0x20 [  739.715828]  devres_release_all\u002B0xad/0xf0 [  739.715843]  device_unbind_cleanup\u002B0x12/0xa0 [  739.715850]  device_release_driver_internal\u002B0x1b7/0x210 [  739.715856]  device_driver_detach\u002B0x14/0x20 [  739.715860]  unbind_store\u002B0xa6/0xb0 [  739.715865]  drv_attr_store\u002B0x21/0x30 [  739.715868]  sysfs_kf_write\u002B0x48/0x60 [  739.715873]  kernfs_fop_write_iter\u002B0x16b/0x240 [  739.715878]  vfs_write\u002B0x266/0x520 [  739.715886]  ksys_write\u002B0x72/0xe0 [  739.715890]  __x64_sys_write\u002B0x19/0x20 [  739.715893]  x64_sys_call\u002B0xa15/0xa30 [  739.715900]  do_syscall_64\u002B0xd8/0xab0 [  739.715905]  entry_SYSCALL_64_after_hwframe\u002B0x4b/0x53  and then finally file close blows up:  [  743.186530] Oops: general protection fault, probably for non-canonical address 0xdead000000000122: 0000 [#1] SMP [  743.186535] CPU: 3 UID: 1000 PID: 3453 Comm: kwin_wayland Tainted: G        W           7.0.0-rc1-valkyria\u002B #110 PREEMPT_{RT,(lazy)} [  743.186537] Tainted: [W]=WARN [  743.186538] Hardware name: Gigabyte Technology Co., Ltd. X299 AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021 [  743.186539] RIP: 0010:drm_framebuffer_cleanup\u002B0x55/0xc0 [drm] [  743.186588] Code: d8 72 73 0f b6 42 05 ff c3 39 c3 72 e8 49 8d bd 50 07 00 00 31 f6 e8 3a 80 d3 e1 49 8b 44 24 10 49 8d 7c 24 08 49 8b 54 24 08 \u003C48\u003E 3b 38 0f 85 95 7f 02 00 48 3b 7a 08 0f 85 8b 7f 02 00 48 89 42 [  743.186589] RSP: 0018:ffffc900085e3cf8 EFLAGS: 00 ---truncated---",
  "published": "2026-04-03T16:16:34Z",
  "severity": "",
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.19.10-1",
      "fix": "DEBIAN-CVE-2026-23471",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-23471",
      "released": "2026-04-03T16:16:34Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}