CVE-2026-23132

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23132", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.971Z", "datePublished": "2026-02-14T15:14:32.334Z", "dateUpdated": "2026-05-11T22:00:45.341Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:00:45.341Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bind\n\nFix several issues in dw_dp_bind() error handling:\n\n1. Missing return after drm_bridge_attach() failure - the function\n continued execution instead of returning an error.\n\n2. Resource leak: drm_dp_aux_register() is not a devm function, so\n drm_dp_aux_unregister() must be called on all error paths after\n aux registration succeeds. This affects errors from:\n - drm_bridge_attach()\n - phy_init()\n - devm_add_action_or_reset()\n - platform_get_irq()\n - devm_request_threaded_irq()\n\n3. Bug fix: platform_get_irq() returns the IRQ number or a negative\n error code, but the error path was returning ERR_PTR(ret) instead\n of ERR_PTR(dp->irq).\n\nUse a goto label for cleanup to ensure consistent error handling."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/bridge/synopsys/dw-dp.c"], "versions": [{"version": "86eecc3a9c2e06462f6a273fcd24150b6da787de", "lessThan": "569ed6a73e927a34cae4ae6de1464c0737a5ec44", "status": "affected", "versionType": "git"}, {"version": "86eecc3a9c2e06462f6a273fcd24150b6da787de", "lessThan": "1a0f69e3c28477b97d3609569b7e8feb4b6162e8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/bridge/synopsys/dw-dp.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.8", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/569ed6a73e927a34cae4ae6de1464c0737a5ec44"}, {"url": "https://git.kernel.org/stable/c/1a0f69e3c28477b97d3609569b7e8feb4b6162e8"}], "title": "drm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bind", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/bridge/synopsys/dw-dp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "569ed6a73e927a34cae4ae6de1464c0737a5ec44", "status": "affected", "version": "86eecc3a9c2e06462f6a273fcd24150b6da787de", "versionType": "git"}, {"lessThan": "1a0f69e3c28477b97d3609569b7e8feb4b6162e8", "status": "affected", "version": "86eecc3a9c2e06462f6a273fcd24150b6da787de", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/bridge/synopsys/dw-dp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7B26C1E1-97A9-48B8-81C6-B6A3A0FC6C7E", "versionEndExcluding": "6.18.8", "versionStartIncluding": "6.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bind\n\nFix several issues in dw_dp_bind() error handling:\n\n1. Missing return after drm_bridge_attach() failure - the function\n continued execution instead of returning an error.\n\n2. Resource leak: drm_dp_aux_register() is not a devm function, so\n drm_dp_aux_unregister() must be called on all error paths after\n aux registration succeeds. This affects errors from:\n - drm_bridge_attach()\n - phy_init()\n - devm_add_action_or_reset()\n - platform_get_irq()\n - devm_request_threaded_irq()\n\n3. Bug fix: platform_get_irq() returns the IRQ number or a negative\n error code, but the error path was returning ERR_PTR(ret) instead\n of ERR_PTR(dp->irq).\n\nUse a goto label for cleanup to ensure consistent error handling."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/bridge: synopsys: dw-dp: corregir rutas de error de dw_dp_bind\n\nCorregir varios problemas en el manejo de errores de dw_dp_bind():\n\n1. Retorno faltante despu\u00e9s de un fallo de drm_bridge_attach(): la funci\u00f3n continu\u00f3 la ejecuci\u00f3n en lugar de devolver un error.\n\n2. Fuga de recursos: drm_dp_aux_register() no es una funci\u00f3n devm, por lo que drm_dp_aux_unregister() debe ser llamada en todas las rutas de error despu\u00e9s de que el registro auxiliar tenga \u00e9xito. Esto afecta a los errores de:\n - drm_bridge_attach()\n - phy_init()\n - devm_add_action_or_reset()\n - platform_get_irq()\n - devm_request_threaded_irq()\n\n3. Correcci\u00f3n de error: platform_get_irq() devuelve el n\u00famero IRQ o un c\u00f3digo de error negativo, pero la ruta de error estaba devolviendo ERR_PTR(ret) en lugar de ERR_PTR(dp->irq).\n\nUsar una etiqueta goto para la limpieza para asegurar un manejo de errores consistente."}], "id": "CVE-2026-23132", "lastModified": "2026-06-17T10:20:57.503", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-02-14T16:15:53.163", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1a0f69e3c28477b97d3609569b7e8feb4b6162e8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/569ed6a73e927a34cae4ae6de1464c0737a5ec44"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bind", "id": "2439866", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439866"}, "csaw": false, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bind\nFix several issues in dw_dp_bind() error handling:\n1. Missing return after drm_bridge_attach() failure - the function\ncontinued execution instead of returning an error.\n2. Resource leak: drm_dp_aux_register() is not a devm function, so\ndrm_dp_aux_unregister() must be called on all error paths after\naux registration succeeds. This affects errors from:\n- drm_bridge_attach()\n- phy_init()\n- devm_add_action_or_reset()\n- platform_get_irq()\n- devm_request_threaded_irq()\n3. Bug fix: platform_get_irq() returns the IRQ number or a negative\nerror code, but the error path was returning ERR_PTR(ret) instead\nof ERR_PTR(dp->irq).\nUse a goto label for cleanup to ensure consistent error handling."], "name": "CVE-2026-23132", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23132\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23132\nhttps://lore.kernel.org/linux-cve-announce/2026021437-CVE-2026-23132-175d@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[86eecc3a9c2e06462f6a273fcd24150b6da787de,569ed6a73e927a34cae4ae6de1464c0737a5ec44)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[86eecc3a9c2e06462f6a273fcd24150b6da787de,1a0f69e3c28477b97d3609569b7e8feb4b6162e8)"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.8,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19,*]"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-18T18:05:31.947012+00:00", "value": {"mitigation_remediation": ["Upgrade to a Linux kernel version that includes the dw_dp_bind fix, such as kernel 6.19.0 or later releases.", "If a kernel upgrade is not immediately possible, disable or unplug the dw-dp hardware to prevent the affected driver from being loaded.", "Monitor kernel logs for unexpected errors or crashes originating from drm_dp or dw_dp_bind to detect potential exploitation attempts."], "summary": {"action": "Immediate Patch", "impact": "Kernel Crash / Denial of Service"}, "threat_synthesis": {"affected_systems": "Systems running any Linux kernel release that contains the dw_dp_bind implementation before the fix\u2014specifically kernel 6.19 RC1 through RC6 and any earlier stable branches that omit the patch\u2014are affected. The problem exists in the generic Linux kernel code and therefore applies to all distributions shipping those kernel versions.", "description_and_impact": "The dw-dp driver for Synopsys devices in the Linux kernel handles errors during the binding of DRM bridges incorrectly. When drm_bridge_attach() or other functions fail, the driver continues executing instead of returning, causing undefined states. Also, the non\u2011devm auxiliary registration isn\u2019t rolled back on failure, leaking resources, and an incorrect error conversion can hide negative return codes. These mistakes can lead to a kernel panic or loss of display functionality, which effectively constitutes a denial\u2011of\u2011service.", "risk_and_exploitability": "The CVSS score is 5.5, with an EPSS score of less than 1%, indicating a low but non\u2011zero likelihood of exploitation, and it is not currently listed in CISA\u2019s KEV catalog. Based on the description, it is inferred that an attacker would need local privileges with access to the DRM subsystem to trigger the faulty error handling. No public exploit has been reported, but an adversary could cause a crash by attempting to bind the driver with manipulated parameters, thereby disrupting system availability."}}}}, "created": "2026-02-16T12:01:34.952956+00:00", "updated": "2026-04-18T18:15:06.578785+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-772"]}