7.8

CVE-2026-68236: linux Double Free

CVSS: 7.8v3.1HighReceived
AliasesUBUNTU-CVE-2026-68236DEBIAN-CVE-2026-68236
Published 10-08-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-68236 is a high (CVSS 7.8) Double Free vulnerability in linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.13%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 25 · Related 20
MGASA-2026-0336MGASA-2026-0337OPENSUSE-SU-2026:21910-1RHSA-2026:81552RHSA-2026:82806RHSA-2026:82807

Timeline

  1. 10-08-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the pointer to NULL. If a later error (e.g., color management failure) triggers the fail label, the error path calls dc_stream_release() again on the same dangling pointer, causing a double release and potential use-after-free. Fix this by setting new_stream to NULL after the initial release. (cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.13%

Chance of exploitation in the next 30 days

Percentile

2%

Versus all other CVEs

30-day change

0.00 pp

From 0.13% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.13%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu168 products
  • linuxAll versions (No fix recorded) | < 6.8.0-147.147 | < 7.0.0-38.38
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 6.8.0-1067.70 | < 7.0.0-1014.14
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.1.190-1 | < 6.12.101-1 | < 7.1.6-1
  • linux-6.12< 6.12.101-1~deb12u1
Linux1 product
  • linux≥ 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f, < 92b7c6e3a1546c6db868b07e93fa6fb950d1d3a0 | ≥ 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f, < bf9c06c70f496f1ba4474caf95c69696c828340e | ≥ 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f, < 01ba5b36898d6258f584269537cc49e7b05cf7c6 | ≥ 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f, < ba8bf1dcbb44773e7a0fd13b42925c644e0d5e76 | ≥ 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f, < 5182e442e61397d446c36995b8f5676942d35b82 | ≥ 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f, < 679f23f0a3606afcef1ffabd72222f00a54ad9e3 | ≥ 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f, < 0676fecbb5242aa22c057e78326d6d6041db034c | ≥ 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f, < 9fa26b9eed6195bf840f39ac183b9a6237548755 | 4.15

3 vendors · 171 products

References

21 links
Show all 21 references