{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-23227",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-23227",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-02-18T14:53:30.784Z",
    "updatedAt": "2026-08-05T12:20:45.582Z",
    "importedAt": "2026-10-24T01:58:02.025Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free\n\nExynos Virtual Display driver performs memory alloc/free operations\nwithout lock protection, which easily causes concurrency problem.\n\nFor example, use-after-free can occur in race scenario like this:\n```\n\tCPU0\t\t\t\tCPU1\t\t\t\tCPU2\n\t----\t\t\t\t----\t\t\t\t----\n  vidi_connection_ioctl()\n    if (vidi->connection) // true\n      drm_edid = drm_edid_alloc(); // alloc drm_edid\n      ...\n      ctx->raw_edid = drm_edid;\n      ...\n\t\t\t\t\t\t\t\tdrm_mode_getconnector()\n\t\t\t\t\t\t\t\t  drm_helper_probe_single_connector_modes()\n\t\t\t\t\t\t\t\t    vidi_get_modes()\n\t\t\t\t\t\t\t\t      if (ctx->raw_edid) // true\n\t\t\t\t\t\t\t\t        drm_edid_dup(ctx->raw_edid);\n\t\t\t\t\t\t\t\t          if (!drm_edid) // false\n\t\t\t\t\t\t\t\t          ...\n\t\t\t\tvidi_connection_ioctl()\n\t\t\t\t  if (vidi->connection) // false\n\t\t\t\t    drm_edid_free(ctx->raw_edid); // free drm_edid\n\t\t\t\t    ...\n\t\t\t\t\t\t\t\t          drm_edid_alloc(drm_edid->edid)\n\t\t\t\t\t\t\t\t            kmemdup(edid); // UAF!!\n\t\t\t\t\t\t\t\t            ...\n```\n\nTo prevent these vulns, at least in vidi_context, member variables related\nto memory alloc/free should be protected with ctx->lock.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "d3b62dbfc7b9bb013926f56db79b60f6c18c392f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "56966a4cfa925ec24edb68ab652a740a7abe2c4d"
            },
            {
              "version": "d3b62dbfc7b9bb013926f56db79b60f6c18c392f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "9e1ef9396a1899925911b1729cb65665420268df"
            },
            {
              "version": "d3b62dbfc7b9bb013926f56db79b60f6c18c392f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "92dd1f38d7db75374dcdaf54f1d79d67bffd54e5"
            },
            {
              "version": "d3b62dbfc7b9bb013926f56db79b60f6c18c392f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "1b24d3e8792bcc050c70e8e0dea6b49c4fc63b13"
            },
            {
              "version": "d3b62dbfc7b9bb013926f56db79b60f6c18c392f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "abfdf449fb3d7b42e85a1ad1c8694b768b1582f4"
            },
            {
              "version": "d3b62dbfc7b9bb013926f56db79b60f6c18c392f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "60b75407c172e1f341a8a5097c5cbc97dbbdd893"
            },
            {
              "version": "d3b62dbfc7b9bb013926f56db79b60f6c18c392f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "0cd2c155740dbd00868ac5a8ae5d14cd6b9ed385"
            },
            {
              "version": "d3b62dbfc7b9bb013926f56db79b60f6c18c392f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "52b330799e2d6f825ae2bb74662ec1b10eb954bb"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "3.6",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "3.6"
            },
            {
              "version": "5.10.253",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.203",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.167",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.130",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.77",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.11",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "6.19.1",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.19.*"
            },
            {
              "version": "7.0",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}