CVE-2026-72452

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the drm/i915 component where the intel crtc put color blobs() function drops CRTC color blob references but fails to clear the corresponding pointers. This becomes problematic in intel crtc prepare cleared state(), which frees the old CRTC hardware state before calling intel dp tunnel atomic clear stream bw(). If the latter function fails (for example, with a -EDEADLK error) while looking up the DP tunnel group state, the function returns without completing the preparation. Consequently, the atomic core may trigger intel crtc free hw state() again for the same state, leading to a double drop of the same blob references.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.