---
id: CVE-2026-31571
title: 'drm/i915: Unlink NV12 planes earlier'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/i915: Unlink NV12 planes earlier

  unlink_nv12_plane() will clobber parts of the plane state
  potentially already set up by plane_atomic_check(), so we
  must make sure…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6a01df2f1b2a3b29721143729a3feff816bc0083 <
    70e2eb91cb6310a3508439f6f2539dfffa0abf77
  - >-
    Linux >= 6a01df2f1b2a3b29721143729a3feff816bc0083 <
    12f3b6cbab8fbeb95097685b40f0147406cf9746
  - >-
    Linux >= 6a01df2f1b2a3b29721143729a3feff816bc0083 <
    bfa71b7a9dc6b5b8af157686e03308291141d00c
  - Linux 6.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:39:14.635829Z'
published: '2026-04-24'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:45:08.323Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31571'
references:
  - url: 'https://git.kernel.org/stable/c/70e2eb91cb6310a3508439f6f2539dfffa0abf77'
  - url: 'https://git.kernel.org/stable/c/12f3b6cbab8fbeb95097685b40f0147406cf9746'
  - url: 'https://git.kernel.org/stable/c/bfa71b7a9dc6b5b8af157686e03308291141d00c'
tags:
  - cve.org
epss: 0.00121
epssPercentile: 0.01897
ingestedAt: '2026-11-05T23:41:31.966Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Unlink NV12 planes earlier

unlink_nv12_plane() will clobber parts of the plane state
potentially already set up by plane_atomic_check(), so we
must make sure not to call the two in the wrong order.
The problem happens when a plane previously selected as
a Y plane is now configured as a normal plane by user space.
plane_atomic_check() will first compute the proper plane
state based on the userspace request, and unlink_nv12_plane()
later clears some of the state.

This used to work on account of unlink_nv12_plane() skipping
the state clearing based on the plane visibility. But I removed
that check, thinking it was an impossible situation. Now when
that situation happens unlink_nv12_plane() will just WARN
and proceed to clobber the state.

Rather than reverting to the old way of doing things, I think
it's more clear if we unlink the NV12 planes before we even
compute the new plane state.

(cherry picked from commit 017ecd04985573eeeb0745fa2c23896fb22ee0cc)

## Affected

- `Linux >= 6a01df2f1b2a3b29721143729a3feff816bc0083 < 70e2eb91cb6310a3508439f6f2539dfffa0abf77`
- `Linux >= 6a01df2f1b2a3b29721143729a3feff816bc0083 < 12f3b6cbab8fbeb95097685b40f0147406cf9746`
- `Linux >= 6a01df2f1b2a3b29721143729a3feff816bc0083 < bfa71b7a9dc6b5b8af157686e03308291141d00c`
- `Linux 6.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.