CVE-2025-40323
BaseFortify
Publication date: 2025-12-08
Last updated on: 2026-04-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free (UAF) issue in the Linux kernel's framebuffer console (fbcon) subsystem. When a framebuffer device is unregistered, the memory for its mode list is freed, but the corresponding pointers in the global fb_display array are not set to NULL. This leaves wild pointers that can be accessed later, causing a use-after-free error. The issue was discovered through syzkaller and involves accessing freed memory during framebuffer mode operations, which can lead to kernel crashes or undefined behavior.
How can this vulnerability impact me? :
This vulnerability can lead to kernel crashes or instability due to use-after-free memory access in the framebuffer console subsystem. Exploiting this issue could potentially allow an attacker to execute arbitrary code in kernel mode or cause denial of service by crashing the system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for KASAN (Kernel Address Sanitizer) reports indicating a slab-use-after-free in fb_mode_is_equal. Specifically, look for messages similar to: 'BUG: KASAN: slab-use-after-free in fb_mode_is_equal'. You can check kernel logs using commands like 'dmesg | grep KASAN' or 'journalctl -k | grep KASAN'. Additionally, reproducing the issue involves loading and unloading framebuffer devices and observing for use-after-free errors in the logs.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding loading or unloading framebuffer kernel modules that register additional /dev/fb devices until a patched kernel is applied. Also, refrain from switching console modes that trigger the framebuffer unregistration process. Applying the kernel patch that sets fb_display[i]->mode to NULL when the mode is released will resolve the issue. Until then, monitor for related kernel errors and avoid operations that trigger the vulnerability.