All vulnerabilities
CVE-2026-97604

Linux: fbdev: vfb: defer cleanup until the last reference

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in040ce3950f64a11e9ee5646c8aaa91fd2e29e245Also 86356f13598f59f5acb1754895747dcdaf65a254, 5ff1effb047e465cde193d7df95988aa1520035e and 1 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 040ce3950f64a11e9ee5646c8aaa91fd2e29e245LinuxCVE List
  • 86356f13598f59f5acb1754895747dcdaf65a254LinuxCVE List
  • 5ff1effb047e465cde193d7df95988aa1520035eLinuxCVE List
  • 3c91e51a53cf805e551e5dc8149cd0539a6dbb9dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: vfb: defer cleanup until the last reference

FBIOGETCMAP takes a shallow snapshot of info->cmap and performs the usercopy after dropping info->lock. vfb_remove() frees the colormap immediately after unregistering the framebuffer, even when an open file still holds a reference to fb_info. A concurrent driver unbind can therefore free the colormap while the ioctl copies it to userspace.

KASAN reports:

BUG: KASAN: slab-use-after-free in _copy_to_user Read of size 512 by task poc/125

_copy_to_user (./include/linux/instrumented.h:129 ./include/linux/uaccess.h:201 lib/usercopy.c:24) fb_cmap_to_user (./include/linux/uaccess.h:230 drivers/video/fbdev/core/fbcmap.c:211) do_fb_ioctl (drivers/video/fbdev/core/fb_chrdev.c:114)

Allocated by task 1: fb_alloc_cmap_gfp (./include/linux/slab.h:973 ./include/linux/slab.h:1290 drivers/video/fbdev/core/fbcmap.c:108) vfb_probe (drivers/video/fbdev/vfb.c:459)

Freed by task 124: fb_dealloc_cmap (drivers/video/fbdev/core/fbcmap.c:151) vfb_remove (drivers/video/fbdev/vfb.c:489)

unregister_framebuffer() drops the registration reference, and fbdev calls fb_destroy after the last put_fb_info(). Move the registered framebuffer's cleanup into an fb_destroy callback so its colormap and screen buffer stay alive until all file references have been released.

Text from CVE List

Affected versions 18

  • Linuxaffected: 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a before bf49eac7ed11aabd0b9b790c062742a8e4be97c6CVE List
  • Linuxaffected: 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a before 040ce3950f64a11e9ee5646c8aaa91fd2e29e245CVE List
  • Linuxaffected: 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a before ab664e279eb2a68e55895dd115a9488807280f07CVE List
  • Linuxaffected: 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a before de5a0eda59fe4b3eacd1a67c992e54766bb6683fCVE List
  • Linuxaffected: 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a before 86356f13598f59f5acb1754895747dcdaf65a254CVE List
  • Linuxaffected: 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a before 5ff1effb047e465cde193d7df95988aa1520035eCVE List
  • Linuxaffected: 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a before 3c91e51a53cf805e551e5dc8149cd0539a6dbb9dCVE List
  • Linuxaffected: 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a before a0a34a40ed299c9c7cff6af163a5b883ee9d6d73CVE List
  • Linuxaffected: 2.6.30CVE List
  • Linuxunaffected: all versions before 2.6.30CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8