CVE-2026-31571

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31571", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.117Z", "datePublished": "2026-04-24T14:35:50.094Z", "dateUpdated": "2026-11-05T21:45:08.323Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:11:21.787Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Unlink NV12 planes earlier\n\nunlink_nv12_plane() will clobber parts of the plane state\npotentially already set up by plane_atomic_check(), so we\nmust make sure not to call the two in the wrong order.\nThe problem happens when a plane previously selected as\na Y plane is now configured as a normal plane by user space.\nplane_atomic_check() will first compute the proper plane\nstate based on the userspace request, and unlink_nv12_plane()\nlater clears some of the state.\n\nThis used to work on account of unlink_nv12_plane() skipping\nthe state clearing based on the plane visibility. But I removed\nthat check, thinking it was an impossible situation. Now when\nthat situation happens unlink_nv12_plane() will just WARN\nand proceed to clobber the state.\n\nRather than reverting to the old way of doing things, I think\nit's more clear if we unlink the NV12 planes before we even\ncompute the new plane state.\n\n(cherry picked from commit 017ecd04985573eeeb0745fa2c23896fb22ee0cc)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/i915/display/intel_plane.c"], "versions": [{"version": "6a01df2f1b2a3b29721143729a3feff816bc0083", "lessThan": "70e2eb91cb6310a3508439f6f2539dfffa0abf77", "status": "affected", "versionType": "git"}, {"version": "6a01df2f1b2a3b29721143729a3feff816bc0083", "lessThan": "12f3b6cbab8fbeb95097685b40f0147406cf9746", "status": "affected", "versionType": "git"}, {"version": "6a01df2f1b2a3b29721143729a3feff816bc0083", "lessThan": "bfa71b7a9dc6b5b8af157686e03308291141d00c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/i915/display/intel_plane.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/70e2eb91cb6310a3508439f6f2539dfffa0abf77"}, {"url": "https://git.kernel.org/stable/c/12f3b6cbab8fbeb95097685b40f0147406cf9746"}, {"url": "https://git.kernel.org/stable/c/bfa71b7a9dc6b5b8af157686e03308291141d00c"}], "title": "drm/i915: Unlink NV12 planes earlier", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31571", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:39:14.635829Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:45:08.323Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31571", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:39:14.635829Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:39:16.587Z"}}], "cna": {"title": "drm/i915: Unlink NV12 planes earlier", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6a01df2f1b2a3b29721143729a3feff816bc0083", "lessThan": "70e2eb91cb6310a3508439f6f2539dfffa0abf77", "versionType": "git"}, {"status": "affected", "version": "6a01df2f1b2a3b29721143729a3feff816bc0083", "lessThan": "12f3b6cbab8fbeb95097685b40f0147406cf9746", "versionType": "git"}, {"status": "affected", "version": "6a01df2f1b2a3b29721143729a3feff816bc0083", "lessThan": "bfa71b7a9dc6b5b8af157686e03308291141d00c", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/i915/display/intel_plane.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"status": "unaffected", "version": "0", "lessThan": "6.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/i915/display/intel_plane.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/70e2eb91cb6310a3508439f6f2539dfffa0abf77"}, {"url": "https://git.kernel.org/stable/c/12f3b6cbab8fbeb95097685b40f0147406cf9746"}, {"url": "https://git.kernel.org/stable/c/bfa71b7a9dc6b5b8af157686e03308291141d00c"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Unlink NV12 planes earlier\n\nunlink_nv12_plane() will clobber parts of the plane state\npotentially already set up by plane_atomic_check(), so we\nmust make sure not to call the two in the wrong order.\nThe problem happens when a plane previously selected as\na Y plane is now configured as a normal plane by user space.\nplane_atomic_check() will first compute the proper plane\nstate based on the userspace request, and unlink_nv12_plane()\nlater clears some of the state.\n\nThis used to work on account of unlink_nv12_plane() skipping\nthe state clearing based on the plane visibility. But I removed\nthat check, thinking it was an impossible situation. Now when\nthat situation happens unlink_nv12_plane() will just WARN\nand proceed to clobber the state.\n\nRather than reverting to the old way of doing things, I think\nit's more clear if we unlink the NV12 planes before we even\ncompute the new plane state.\n\n(cherry picked from commit 017ecd04985573eeeb0745fa2c23896fb22ee0cc)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.15"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:11:21.787Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31571", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:45:08.323Z", "dateReserved": "2026-03-09T15:48:24.117Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-24T14:35:50.094Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/i915/display/intel_plane.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "70e2eb91cb6310a3508439f6f2539dfffa0abf77", "status": "affected", "version": "6a01df2f1b2a3b29721143729a3feff816bc0083", "versionType": "git"}, {"lessThan": "12f3b6cbab8fbeb95097685b40f0147406cf9746", "status": "affected", "version": "6a01df2f1b2a3b29721143729a3feff816bc0083", "versionType": "git"}, {"lessThan": "bfa71b7a9dc6b5b8af157686e03308291141d00c", "status": "affected", "version": "6a01df2f1b2a3b29721143729a3feff816bc0083", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/i915/display/intel_plane.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "36BA90C1-6493-4928-A360-8DF69289C352", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.15.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*", "matchCriteriaId": "A1ECC65A-EE37-4479-8E99-4BB68A22A31F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Unlink NV12 planes earlier\n\nunlink_nv12_plane() will clobber parts of the plane state\npotentially already set up by plane_atomic_check(), so we\nmust make sure not to call the two in the wrong order.\nThe problem happens when a plane previously selected as\na Y plane is now configured as a normal plane by user space.\nplane_atomic_check() will first compute the proper plane\nstate based on the userspace request, and unlink_nv12_plane()\nlater clears some of the state.\n\nThis used to work on account of unlink_nv12_plane() skipping\nthe state clearing based on the plane visibility. But I removed\nthat check, thinking it was an impossible situation. Now when\nthat situation happens unlink_nv12_plane() will just WARN\nand proceed to clobber the state.\n\nRather than reverting to the old way of doing things, I think\nit's more clear if we unlink the NV12 planes before we even\ncompute the new plane state.\n\n(cherry picked from commit 017ecd04985573eeeb0745fa2c23896fb22ee0cc)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/i915: Desvincular planos NV12 antes\n\nunlink_nv12_plane() sobrescribir\u00e1 partes del estado del plano potencialmente ya configuradas por plane_atomic_check(), por lo que debemos asegurarnos de no llamar a las dos en el orden incorrecto. El problema ocurre cuando un plano previamente seleccionado como un plano Y ahora se configura como un plano normal por el espacio de usuario. plane_atomic_check() primero calcular\u00e1 el estado del plano adecuado basado en la solicitud del espacio de usuario, y unlink_nv12_plane() m\u00e1s tarde borra parte del estado.\n\nEsto sol\u00eda funcionar debido a que unlink_nv12_plane() omit\u00eda la limpieza del estado basada en la visibilidad del plano. Pero elimin\u00e9 esa verificaci\u00f3n, pensando que era una situaci\u00f3n imposible. Ahora, cuando esa situaci\u00f3n ocurre, unlink_nv12_plane() simplemente ADVERTIR\u00c1 y proceder\u00e1 a sobrescribir el estado.\n\nEn lugar de revertir a la antigua forma de hacer las cosas, creo que es m\u00e1s claro si desvinculamos los planos NV12 incluso antes de calcular el nuevo estado del plano.\n\n(seleccionado de la confirmaci\u00f3n 017ecd04985573eeeb0745fa2c23896fb22ee0cc)"}], "id": "CVE-2026-31571", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31571", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:39:14.635829Z", "version": "2.0.3"}}]}, "published": "2026-04-24T15:16:31.653", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/12f3b6cbab8fbeb95097685b40f0147406cf9746"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/70e2eb91cb6310a3508439f6f2539dfffa0abf77"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bfa71b7a9dc6b5b8af157686e03308291141d00c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/i915: Unlink NV12 planes earlier", "id": "2461562", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461562"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-366", "details": ["A flaw was found in the Linux kernel's `drm/i915` component. A local user can exploit this by configuring a graphics plane, previously designated for Y-component data (Y plane), as a standard plane. This incorrect configuration leads to a race condition where the `unlink_nv12_plane()` function improperly clears parts of the plane's state after it has been set by `plane_atomic_check()`. The consequence is data corruption within the graphics plane state, which can result in system instability or a denial of service (DoS)."], "name": "CVE-2026-31571", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31571\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31571\nhttps://lore.kernel.org/linux-cve-announce/2026042402-CVE-2026-31571-41f9@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6a01df2f1b2a3b29721143729a3feff816bc0083,70e2eb91cb6310a3508439f6f2539dfffa0abf77)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6a01df2f1b2a3b29721143729a3feff816bc0083,12f3b6cbab8fbeb95097685b40f0147406cf9746)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6a01df2f1b2a3b29721143729a3feff816bc0083,bfa71b7a9dc6b5b8af157686e03308291141d00c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T14:10:05.097662+00:00", "value": {"mitigation_remediation": ["Update the kernel to a version that includes the fix for unlink_nv12_plane(), such as the latest 6.15 patch release or any 7.x release that incorporates the patch.", "If an immediate kernel upgrade is not possible, restrict unprivileged users\u2019 access to /dev/dri/* so that only trusted accounts can interact with the graphics subsystem until the patch is applied.", "Monitor kernel logs for WARN messages containing unlink_nv12_plane() and investigate any such occurrences to confirm that the flaw has not been triggered."], "summary": {"action": "Apply Patch", "impact": "Kernel data corruption leading to potential crashes"}, "threat_synthesis": {"affected_systems": "Vulnerable kernels include Linux 6.15 and all 7.0 release\u2011candidate builds (rc1 through rc7). The flaw manifests on systems equipped with Intel i915 graphics hardware that interact with the DRM subsystem.", "description_and_impact": "The unlink_nv12_plane() routine in the Intel i915 DRM driver overwrites parts of the plane state that have already been established by plane_atomic_check(). This behavior aligns with CWE\u2011366, which denotes unsafe handling of internal state that can result in corruption. The consequence is a warning followed by kernel data structure corruption, potentially causing crashes or undefined behavior within the graphics subsystem and denying service for processes that rely on the DRM interface.", "risk_and_exploitability": "The CVSS score of 5.5 reflects moderate severity. An EPSS score of less than 1\u202f% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local user who can supply a DRM request that triggers the plane type change, making the attack vector local. An attacker would need to drive the driver into the problematic state transition; successful exploitation could crash the kernel or cause a denial of service for all graphics users."}}}}, "created": "2026-04-27T19:00:15.751240+00:00", "updated": "2026-04-28T14:15:34.922889+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}