CVE-2026-63826

Received Received - Intake

Use-After-Free in Linux Kernel Framebuffer Subsystem

Publication date: 2026-07-19

Last updated on: 2026-07-20

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fbdev: fix use-after-free in store_modes() store_modes() replaces a framebuffer's modelist with modes from userspace. On success it frees the old modelist with fb_destroy_modelist(). Two fields still point into that freed list. One pointer is fb_display[i].mode, the mode a console is using. fbcon_new_modelist() moves these pointers to the new list. It only does so for consoles still mapped to the framebuffer. An unmapped console is skipped and keeps its stale pointer. Unbinding fbcon, for example, sets con2fb_map[i] to -1 but leaves fb_display[i].mode set. An FBIOPUT_VSCREENINFO ioctl with FB_ACTIVATE_INV_MODE later reaches fbcon_mode_deleted(). That function reads the stale fb_display[i].mode through fb_mode_is_equal(). The read is a use-after-free. The other pointer is fb_info->mode, the current mode. It is set through the mode sysfs attribute. store_modes() does not update fb_info->mode, so it is left pointing into the freed list. show_mode(), the attribute's read handler, dereferences the stale fb_info->mode through mode_string(). The read is a use-after-free. Clear both pointers before freeing the list. Commit a1f305893074 ("fbcon: Set fb_display[i]->mode to NULL when the mode is released") added the helper fbcon_delete_modelist(). It clears every fb_display[i].mode that points into a given list. So far it is called only from the unregister path. Call it from store_modes() too, and set fb_info->mode to NULL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-20

Generated

2026-07-20

AI Q&A

2026-07-19

EPSS Evaluated

N/A

NVD

CVE-2026-63826

EUVD

EUVD-2026-45492

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's framebuffer device (fbdev) subsystem. It occurs in the store_modes() function which replaces a framebuffer's mode list with new modes from userspace. The issue happens because two pointers (fb_display[i].mode and fb_info->mode) are not cleared before the old mode list is freed, leading to potential memory corruption when these stale pointers are later accessed.

Detection Guidance

This vulnerability is specific to the Linux kernel's framebuffer subsystem and requires kernel-level inspection. Detection involves checking for use-after-free conditions in fbdev operations. No direct network detection commands exist; instead, monitor kernel logs for crashes or errors related to framebuffer operations. Commands like dmesg | grep -i fbdev or journalctl -k | grep -i fbdev may reveal issues.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a system crash or potentially execute arbitrary code with kernel privileges. It may lead to memory corruption, system instability, or privilege escalation if exploited.

Compliance Impact

This vulnerability involves a use-after-free in the Linux kernel's framebuffer device subsystem, which could lead to memory corruption or crashes. It does not directly relate to data handling, privacy, or security controls typically addressed by GDPR or HIPAA. Compliance impact would depend on system-specific usage and whether the affected component processes sensitive data.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve the issue. Avoid using framebuffer operations that trigger the vulnerable code paths, such as FBIOPUT_VSCREENINFO with FB_ACTIVATE_INV_MODE. If fbcon is not needed, unbind it to prevent stale pointer access. Monitor system stability after updates.

Hi! I’m here to help you understand CVE-2026-63826. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70