CVE-2026-43236 is a use-after-free vulnerability in the Linux kernel's drm/atmel-hlcdc driver. The flaw occurs because the atmel_hlcdc_plane_atomic_duplicate_state() callback improperly duplicates the drm_plane_state, leaving a stale commit pointer that can be used after the original memory is freed. This can happen when closing and reopening the device node while another DRM client remains attached. The vulnerability has a high severity with a CVSS score of 7.8.