{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23471", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "REJECTED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.022Z", "datePublished": "2026-04-03T15:15:50.233Z", "dateUpdated": "2026-04-13T13:26:09.459Z", "dateRejected": "2026-04-13T13:26:09.459Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-04-13T13:26:09.459Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}], "id": "CVE-2026-23471", "lastModified": "2026-04-13T14:16:09.590", "metrics": {}, "published": "2026-04-03T16:16:34.773", "references": [], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Rejected"}

{"bugzilla": {"description": "kernel: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug", "id": "2454808", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454808"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically affecting the Intel Xe Graphics driver. A local user could exploit a use-after-free vulnerability by triggering the `drm_dev_unplug` function. This could lead to dereferencing freed memory, resulting in a system crash and a Denial of Service (DoS)."], "name": "CVE-2026-23471", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23471\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23471\nhttps://lore.kernel.org/linux-cve-announce/2026040322-CVE-2026-23471-f1bc@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bee330f3d67273a68dcb99f59480d59553c008b2,54df178324b268c62f847381e2813a1b0f971384)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bee330f3d67273a68dcb99f59480d59553c008b2,eec4d5758f33925e0bdb4a32b45d86a68afa4516)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bee330f3d67273a68dcb99f59480d59553c008b2,7e3ec3bf4015156dcc5bafed13f26a587cc37f5c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bee330f3d67273a68dcb99f59480d59553c008b2,074d06d3724ccab0c5bb779db594a82b6405e501)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bee330f3d67273a68dcb99f59480d59553c008b2,e493c135980f90c20308d1a98f2e0d1223951e94)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bee330f3d67273a68dcb99f59480d59553c008b2,6bee098b91417654703e17eb5c1822c6dfd0c01d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.167,6.20)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.78,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.20,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-03T18:41:12.211352+00:00", "value": {"mitigation_remediation": ["Upgrade the Linux kernel to a version that includes the DRM use\u2011after\u2011free fix (see commits 074d06d3, 54df1783, 6bee098b, 7e3ec3bf, e493c135, eec4d575).", "After upgrading, reboot the system and verify that drm_WARN_ON or general protection fault messages no longer appear in dmesg.", "If an immediate kernel upgrade is not feasible, suspend hot\u2011plug or compositor shutdown events that trigger drm_dev_unplug\u2014e.g., avoid unplugging GPU devices or restarting the display server\u2014until the patch is applied.", "Monitor system logs for DRM-related OOPS warnings and apply future kernel updates as they become available."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via kernel crash"}, "threat_synthesis": {"affected_systems": "This issue affects all Linux kernel releases that contain the buggy DRM code and have not yet incorporated the fix. The affected product is the Linux kernel itself; any distribution shipping an unpatched kernel version may be vulnerable. No specific version numbers are listed, but the description refers to the fix being applied in a recent patch commit. Systems running recent desktop environments with GPUs that use the DRM stack are likely to experience the problem when a compositor exits or a device is unplugged.", "description_and_impact": "The vulnerability arises from a use\u2011after\u2011free in the Linux kernel DRM subsystem. When drm_dev_unplug is called, framebuffer and property blob pointers that have already been freed are incorrectly dereferenced, causing kernel OOPSes and general protection faults. These crashes can bring the affected system to a state where it cannot continue to serve users or services, effectively resulting in a denial of service. The weakness is a classic use\u2011after\u2011free scenario (CWE\u2011416).", "risk_and_exploitability": "The severity is high because a fault in the kernel can trigger a crash, though the CVSS score and EPSS probability are not publicly available. The vulnerability is present in kernel mode and does not require user input beyond normal device unplug or compositor shutdown events, so it is readily exploitable in the attack surface present on typical user machines. The vulnerability is not recorded in CISA\u2019s KEV catalog at this time, but the lack of available score data does not diminish the risk of service disruption. An attacker could force the system to crash by manipulating device hotplug events or by causing a compositor exit in a controlled way, allowing them to achieve denial of service or potentially privilege escalation depending on kernel configuration."}}}}, "created": "2026-04-03T21:13:27.979275+00:00", "updated": "2026-04-03T21:15:42.859825+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}