CVE-2026-23236
Modified
Modified - Updated After Analysis
Improper Memory Copy Vulnerability in Linux fbdev smscufx ioctl
Vulnerability report for CVE-2026-23236, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-03-04
Last updated on: 2026-06-02
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
fbdev: smscufx: properly copy ioctl memory to kernelspace
The UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from
userspace to kernelspace, and instead directly references the memory,
which can cause problems if invalid data is passed from userspace. Fix
this all up by correctly copying the memory before accessing it within
the kernel.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.16 (inc) to 6.1.164 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.201 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.127 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.74 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.13 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.3 (exc) |
| linux | linux_kernel | From 3.2 (inc) to 5.10.251 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
