CVE-2026-53378— drm/colorop: Fix blob property reference tracking in state lifecycle
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 6
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-53378
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
drm/colorop: Fix blob property reference tracking in state lifecycle
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: drm/colorop: Fix blob property reference tracking in state lifecycle The colorop state blob property handling had memory leaks during state duplication, destruction, and reset operations. The implementation failed to follow the established pattern from drm_crtc's handling of DEGAMMA/GAMMA blob properties. Issues fixed: - drm_colorop_atomic_destroy_state() was freeing state memory without releasing the blob reference, causing a leak - drm_colorop_reset() was directly freeing old state with kfree() instead of properly destroying it, leaking blob references - drm_colorop_cleanup() had duplicate blob cleanup code Changes: - Add __drm_atomic_helper_colorop_destroy_state() helper to properly release blob references before freeing state memory - Update drm_colorop_atomic_destroy_state() to call the helper - Fix drm_colorop_reset() to use drm_colorop_atomic_destroy_state() for proper cleanup of old state - Simplify drm_colorop_cleanup() to use the common destruction path This matches the well-tested pattern used by drm_crtc since 2016 and ensures proper reference counting throughout the state lifecycle. Co-developed by Claude Sonnet 4.5.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-53378
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53378
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-53378 (2)
Same Patch Batch · Linux · 2026-07-19 · 431 CVEs total
| CVE-2026-63905 | usbip: vudc: Fix use after free bug in vudc_remove due to race condition | |
| CVE-2026-63891 | thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() | |
| CVE-2026-63892 | thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow | |
| CVE-2026-63893 | thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() | |
| CVE-2026-63895 | usb: gadget: f_fs: copy only received bytes on short ep0 read | |
| CVE-2026-63894 | usb: gadget: f_fs: serialize DMABUF cancel against request completion | |
| CVE-2026-63896 | usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling | |
| CVE-2026-63897 | USB: serial: mct_u232: fix missing interrupt-in transfer sanity check | |
| CVE-2026-63898 | USB: serial: mct_u232: fix memory corruption with small endpoint | |
| CVE-2026-63899 | USB: serial: mxuport: fix memory corruption with small endpoint | |
| CVE-2026-63900 | USB: serial: keyspan: fix missing indat transfer sanity check | |
| CVE-2026-63901 | USB: serial: digi_acceleport: fix memory corruption with small endpoints | |
| CVE-2026-63902 | USB: serial: cypress_m8: validate interrupt packet headers | |
| CVE-2026-63903 | USB: serial: belkin_sa: validate interrupt status length | |
| CVE-2026-63914 | xfrm: route MIGRATE notifications to caller's netns | |
| CVE-2026-63911 | xfrm: iptfs: reset runtime state when cloning SAs | |
| CVE-2026-63912 | xfrm: esp: restore combined single-frag length gate | |
| CVE-2026-63913 | netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check | |
| CVE-2026-63910 | dma-buf: fix UAF in dma_buf_fd() tracepoint | |
| CVE-2026-63915 | nfc: hci: fix out-of-bounds read in HCP header parsing |
Showing top 20 of 431 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-64186
iommu/amd: Remove latent out-of-bounds access in IOMMU debug - CVE-2026-64184
mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - CVE-2026-64185
sysfs: don't remove existing directory on update failure - CVE-2026-64183
efi: Allocate runtime workqueue before ACPI init - CVE-2026-64182
drivers/base/memory: fix memory block reference leak in pois
Same vendor: Linux
- CVE-2026-64186
iommu/amd: Remove latent out-of-bounds access in IOMMU debug - CVE-2026-64184
mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - CVE-2026-64185
sysfs: don't remove existing directory on update failure - CVE-2026-64183
efi: Allocate runtime workqueue before ACPI init - CVE-2026-64182
drivers/base/memory: fix memory block reference leak in pois
V. Comments for CVE-2026-53378
No comments yet