CVE-2026-23366

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23366", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.002Z", "datePublished": "2026-03-25T10:27:48.311Z", "dateUpdated": "2026-11-05T21:33:42.772Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:05:28.991Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/client: Do not destroy NULL modes\n\n'modes' in drm_client_modeset_probe may fail to kcalloc. If this\noccurs, we jump to 'out', calling modes_destroy on it, which\ndereferences it. This may result in a NULL pointer dereference in the\nerror case. Prevent that."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/drm_client_modeset.c"], "versions": [{"version": "3039cc0c0653c6e15130a8719c3237329a954670", "lessThan": "4e3ca5f82346cc23c0a71f1ceb006115ff6b0745", "status": "affected", "versionType": "git"}, {"version": "3039cc0c0653c6e15130a8719c3237329a954670", "lessThan": "9aa3e33f0c7f2679ac599a09e3102c8f716a6321", "status": "affected", "versionType": "git"}, {"version": "3039cc0c0653c6e15130a8719c3237329a954670", "lessThan": "c601fd5414315fc515f746b499110e46272e7243", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/drm_client_modeset.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4e3ca5f82346cc23c0a71f1ceb006115ff6b0745"}, {"url": "https://git.kernel.org/stable/c/9aa3e33f0c7f2679ac599a09e3102c8f716a6321"}, {"url": "https://git.kernel.org/stable/c/c601fd5414315fc515f746b499110e46272e7243"}], "title": "drm/client: Do not destroy NULL modes", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23366", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:28:19.326352Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:33:42.772Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23366", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:28:19.326352Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:28:20.803Z"}}], "cna": {"title": "drm/client: Do not destroy NULL modes", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3039cc0c0653c6e15130a8719c3237329a954670", "lessThan": "4e3ca5f82346cc23c0a71f1ceb006115ff6b0745", "versionType": "git"}, {"status": "affected", "version": "3039cc0c0653c6e15130a8719c3237329a954670", "lessThan": "9aa3e33f0c7f2679ac599a09e3102c8f716a6321", "versionType": "git"}, {"status": "affected", "version": "3039cc0c0653c6e15130a8719c3237329a954670", "lessThan": "c601fd5414315fc515f746b499110e46272e7243", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/drm_client_modeset.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.17", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.7", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/drm_client_modeset.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/4e3ca5f82346cc23c0a71f1ceb006115ff6b0745"}, {"url": "https://git.kernel.org/stable/c/9aa3e33f0c7f2679ac599a09e3102c8f716a6321"}, {"url": "https://git.kernel.org/stable/c/c601fd5414315fc515f746b499110e46272e7243"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/client: Do not destroy NULL modes\n\n'modes' in drm_client_modeset_probe may fail to kcalloc. If this\noccurs, we jump to 'out', calling modes_destroy on it, which\ndereferences it. This may result in a NULL pointer dereference in the\nerror case. Prevent that."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:05:28.991Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23366", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:33:42.772Z", "dateReserved": "2026-01-13T15:37:46.002Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-03-25T10:27:48.311Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/drm_client_modeset.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4e3ca5f82346cc23c0a71f1ceb006115ff6b0745", "status": "affected", "version": "3039cc0c0653c6e15130a8719c3237329a954670", "versionType": "git"}, {"lessThan": "9aa3e33f0c7f2679ac599a09e3102c8f716a6321", "status": "affected", "version": "3039cc0c0653c6e15130a8719c3237329a954670", "versionType": "git"}, {"lessThan": "c601fd5414315fc515f746b499110e46272e7243", "status": "affected", "version": "3039cc0c0653c6e15130a8719c3237329a954670", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/drm_client_modeset.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.17", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5B092616-17E9-4C58-A0D5-624A8FAE8D23", "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.16.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*", "matchCriteriaId": "6238B17D-C12B-458F-A138-97039BFC4595", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/client: Do not destroy NULL modes\n\n'modes' in drm_client_modeset_probe may fail to kcalloc. If this\noccurs, we jump to 'out', calling modes_destroy on it, which\ndereferences it. This may result in a NULL pointer dereference in the\nerror case. Prevent that."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/cliente: No destruir modos NULL\n\n'modes' en drm_client_modeset_probe puede fallar al kcalloc. Si esto ocurre, saltamos a 'out', llamando a modes_destroy sobre \u00e9l, lo que lo desreferencia. Esto puede resultar en una desreferencia de puntero NULL en el caso de error. Prevenir eso."}], "id": "CVE-2026-23366", "lastModified": "2026-11-05T22:18:17.700", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23366", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:28:19.326352Z", "version": "2.0.3"}}]}, "published": "2026-03-25T11:16:35.873", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4e3ca5f82346cc23c0a71f1ceb006115ff6b0745"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9aa3e33f0c7f2679ac599a09e3102c8f716a6321"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c601fd5414315fc515f746b499110e46272e7243"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/client: Do not destroy NULL modes", "id": "2451257", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451257"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-824", "details": ["A flaw was found in the Linux kernel's Direct Rendering Manager (DRM) client component. This vulnerability occurs when the system attempts to destroy an uninitialized memory pointer, specifically the 'modes' variable within the `drm_client_modeset_probe` function, after a memory allocation failure. This can lead to a NULL pointer dereference, potentially causing system instability or a denial of service."], "name": "CVE-2026-23366", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23366\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23366\nhttps://lore.kernel.org/linux-cve-announce/2026032540-CVE-2026-23366-a7c4@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3039cc0c0653c6e15130a8719c3237329a954670,4e3ca5f82346cc23c0a71f1ceb006115ff6b0745)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3039cc0c0653c6e15130a8719c3237329a954670,9aa3e33f0c7f2679ac599a09e3102c8f716a6321)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3039cc0c0653c6e15130a8719c3237329a954670,c601fd5414315fc515f746b499110e46272e7243)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.17,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T17:03:08.489616+00:00", "value": {"mitigation_remediation": ["Apply the latest kernel update that incorporates the fix for the null pointer dereference in drm_client_modeset_probe. The commit references in the official advisory point to the exact patch.", "Consider temporarily disabling the DRM subsystem or the specific driver until a patch is applied to prevent the crash from occurring.", "Monitor system logs for DRM related errors and verify that the kernel is not attempting to free uninitialized mode structures."], "summary": {"action": "Patch", "impact": "Kernel crash/Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Linux kernel\u2019s DRM client module. The CPE string indicates all Linux kernel builds are potentially impacted. No specific kernel versions are listed, so any kernel that includes the DRM subsystem and has not yet applied the upstream patch is vulnerable.", "description_and_impact": "A missing null check in the DRM client\u2019s mode\u2011set probe allows a failure in memory allocation to trigger a null pointer dereference when the code attempts to destroy the partially created mode. This flaw can cause the kernel to crash, resulting in a denial of service. The weakness involves a null pointer dereference (CWE\u2011476) and an early free or use of uninitialized memory (CWE\u2011824).", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not catalogued in CISA\u2019s KEV list. Based on the description, the likely attack vector is local: a user or process that can trigger the DRM mode\u2011set path could cause the crash. Remote exploitation is not explicitly supported or required by the data provided."}}}}, "created": "2026-03-25T21:31:49.722339+00:00", "updated": "2026-04-28T17:15:21.233253+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}