fbdev: vfb: defer cleanup until the last reference

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-97604
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-25 11:17:14 UTC
Updated2026-10-19 10:17:30 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: fbdev: vfb: defer cleanup until the last reference FBIOGETCMAP takes a shallow snapshot of info->cmap and performs the usercopy after dropping info->lock. vfb_remove() frees the colormap immediately after unregistering the framebuffer, even when an open file still holds a reference to fb_info. A concurrent driver unbind can therefore free the colormap while the ioctl copies it to userspace. KASAN reports: BUG: KASAN: slab-use-after-free in _copy_to_user Read of size 512 by task poc/125 _copy_to_user (./include/linux/instrumented.h:129 ./include/linux/uaccess.h:201 lib/usercopy.c:24) fb_cmap_to_user (./include/linux/uaccess.h:230 drivers/video/fbdev/core/fbcmap.c:211) do_fb_ioctl (drivers/video/fbdev/core/fb_chrdev.c:114) Allocated by task 1: fb_alloc_cmap_gfp (./include/linux/slab.h:973 ./include/linux/slab.h:1290 drivers/video/fbdev/core/fbcmap.c:108) vfb_probe (drivers/video/fbdev/vfb.c:459) Freed by task 124: fb_dealloc_cmap (drivers/video/fbdev/core/fbcmap.c:151) vfb_remove (drivers/video/fbdev/vfb.c:489) unregister_framebuffer() drops the registration reference, and fbdev calls fb_destroy after the last put_fb_info(). Move the registered framebuffer's cleanup into an fb_destroy callback so its colormap and screen buffer stay alive until all file references have been released.

Risk And Classification

EPSS: 0.002100000 probability, percentile 0.102540000 (date 2026-10-05)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a bf49eac7ed11aabd0b9b790c062742a8e4be97c6 git Not specified
CNA Linux Linux affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a 040ce3950f64a11e9ee5646c8aaa91fd2e29e245 git Not specified
CNA Linux Linux affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a ab664e279eb2a68e55895dd115a9488807280f07 git Not specified
CNA Linux Linux affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a de5a0eda59fe4b3eacd1a67c992e54766bb6683f git Not specified
CNA Linux Linux affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a 86356f13598f59f5acb1754895747dcdaf65a254 git Not specified
CNA Linux Linux affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a 5ff1effb047e465cde193d7df95988aa1520035e git Not specified
CNA Linux Linux affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a 3c91e51a53cf805e551e5dc8149cd0539a6dbb9d git Not specified
CNA Linux Linux affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a a0a34a40ed299c9c7cff6af163a5b883ee9d6d73 git Not specified
CNA Linux Linux affected 2.6.30 Not specified
CNA Linux Linux unaffected 2.6.30 semver Not specified
CNA Linux Linux unaffected 5.10.271 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.222 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.189 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.158 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.111 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.53 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.7 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/5ff1effb047e465cde193d7df95988aa1520035e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/bf49eac7ed11aabd0b9b790c062742a8e4be97c6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3c91e51a53cf805e551e5dc8149cd0539a6dbb9d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/86356f13598f59f5acb1754895747dcdaf65a254 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ab664e279eb2a68e55895dd115a9488807280f07 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/de5a0eda59fe4b3eacd1a67c992e54766bb6683f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a0a34a40ed299c9c7cff6af163a5b883ee9d6d73 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/040ce3950f64a11e9ee5646c8aaa91fd2e29e245 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report