CVE-2026-90363

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free crash occurs in the Linux kernel when KMS initialization fails. Specifically, when the priv->kms init() function (including mdp4 kms init() and mdp5 kms init()) fails, the display drivers execute mdp4 destroy() or mdp5 kms destroy() to tear down the KMS state. Subsequently, the common error path in msm drm init() calls msm drm uninit(), which triggers msm drm kms uninit(). This results in a second attempt to destroy the same KMS state, leading to the crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.