{"id":7113,"date":"2026-09-04T18:49:25","date_gmt":"2026-09-04T10:49:25","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72452"},"modified":"2026-09-04T18:49:25","modified_gmt":"2026-09-04T10:49:25","slug":"cve-2026-72452","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72452","title":{"rendered":"CVE-2026-72452 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\ndrm\/i915: clear CRTC"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>drm\/i915: clear CRTC color blob pointers after dropping refs<\/p>\n<p>intel_crtc_put_color_blobs() drops the CRTC color blob references, but<br \/>\nleaves the corresponding pointers unchanged.<\/p>\n<p>This can matter in intel_crtc_prepare_cleared_state(), which frees the<br \/>\nold CRTC hw state before calling intel_dp_tunnel_atomic_clear_stream_bw().<br \/>\nThe latter can fail while looking up the DP tunnel group state, for<br \/>\nexample with -EDEADLK.<\/p>\n<p>If that happens, the function returns without completing the cleared<br \/>\nstate preparation. The failed atomic state will then be cleared by the<br \/>\natomic core and intel_crtc_free_hw_state() can be called again for the<br \/>\nsame state, dropping the same blob references again.<\/p>\n<p>Clear the blob pointers after dropping the references so repeated cleanup<br \/>\nof the same CRTC hw state is safe.<\/p>\n<p>(cherry picked from commit d5005addb5f68e8a0edce249506757bdc9e3d8c8)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>drm\/i915: clear CRTC color blob pointers after dropping refs<\/p>\n<p>intel_crtc_put_color_blobs() drops the CRTC color blob references, bu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7113","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7113","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7113"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7113"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7113"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}