The Linux kernel's drm/colorop subsystem had a vulnerability related to improper handling of blob property references in the state lifecycle. Specifically, drm_colorop_atomic_destroy_state() freed state memory without releasing blob references, drm_colorop_reset() freed old state memory directly instead of using the proper destruction method, and drm_colorop_cleanup() contained duplicate blob cleanup code. These issues caused memory leaks (CWE-401). The fix introduced a helper function __drm_atomic_helper_colorop_destroy_state() to correctly release blob references before freeing state memory and updated related functions to use this helper, matching the well-tested drm_crtc pattern since 2016.

The vulnerability causes memory leaks in the kernel's drm/colorop state management, which can degrade system stability or availability over time. There is no impact on confidentiality or integrity. The CVSS vector indicates local attack complexity with low privileges required and no user interaction, but the impact is limited to availability due to memory leaks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves proper reference counting and cleanup in the drm/colorop subsystem. Until an official patch is confirmed, users should monitor vendor advisories for updates and apply patches once available.