PT-2026-20453 · Samsung+1 · Exynos Virtual Display+1

Published 2026-01-01 · Updated 2026-04-20 · CVE-2026-23227

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Exynos Virtual Display driver in the Linux kernel has a concurrency issue due to missing lock protection during memory allocation and deallocation operations. This can lead to a use-after-free condition. The example code provided illustrates a race scenario where a pointer to allocated memory (drm edid) is freed, and then the same memory is reallocated and used, potentially leading to a crash or other unpredictable behavior. The issue involves member variables within the struct vidi context related to memory management. The vidi connection ioctl() and vidi get modes() functions are implicated in the described scenario. The ctx->lock is intended to protect these member variables.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-23227

ECHO-6997-45FE-7CD8

OPENSUSE-SU-2026:10387-1

Affected Products

Exynos Virtual Display

Linux Kernel

References · 56

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23227.json · Exploit
• https://cve.org/CVERecord?id=CVE-2026-23227 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23227 · Security Note
• https://git.kernel.org/stable/c/60b75407c172e1f341a8a5097c5cbc97dbbdd893 · Patch
• https://git.kernel.org/stable/c/abfdf449fb3d7b42e85a1ad1c8694b768b1582f4 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-23227 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23227 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10387-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-23227 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-23227 · Vendor Advisory
• https://git.kernel.org/stable/c/52b330799e2d6f825ae2bb74662ec1b10eb954bb · Patch
• https://ubuntu.com/security/CVE-2026-23227 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-23227 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23227 · Vendor Advisory
• https://git.kernel.org/stable/c/0cd2c155740dbd00868ac5a8ae5d14cd6b9ed385 · Patch