CVE-2026-23039: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix NULL fb and crtc dereferences on USB disconnect On disconnect drm_atomic_helper_disable_all() is called which sets both the fb and crtc for a plane to NULL before invoking a commit. This causes a kernel oops on every display disconnect. Add guards for those dereferences.

Affected products

• Linux Linux: from 6.18, before 6.18.7 (fixed in 6.18.7)

Published 2026-01-31. Last modified 2026-06-17.