drm/colorop: Fix blob property reference tracking in state lifecycle
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/colorop: Fix blob property reference tracking in state lifecycle The colorop state blob property handling had memory leaks during state duplication, destruction, and reset operations. The implementation failed to follow the established pattern from drm_crtc's handling of DEGAMMA/GAMMA blob properties. Issues fixed: • drm_colorop_atomic_destroy_state() was freeing state memory without releasing the blob reference, causing a leak • drm_colorop_reset() was directly freeing old state with kfree() instead of properly destroying it, leaking blob references • drm_colorop_cleanup() had duplicate blob cleanup code Changes: • Add __drm_atomic_helper_colorop_destroy_state() helper to properly release blob references before freeing state memory • Update drm_colorop_atomic_destroy_state() to call the helper • Fix drm_colorop_reset() to use drm_colorop_atomic_destroy_state() for proper cleanup of old state • Simplify drm_colorop_cleanup() to use the common destruction path This matches the well-tested pattern used by drm_crtc since 2016 and ensures proper reference counting throughout the state lifecycle. Co-developed by Claude Sonnet 4.5.
Timeline
- CVE published
Affected versions
- Linux Linux
Version range not reported
- Linux Linux
6.19