CVE-2026-64245

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel fbdev modedb

Publication date: 2026-07-24

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible UAF in fb_find_mode() If mode_option is NULL, it is assigned from mode_option_buf: if (!mode_option) { fb_get_options(NULL, &mode_option_buf); mode_option = mode_option_buf; } Later, name is assigned from mode_option: const char *name = mode_option; However, mode_option_buf is freed before name is no longer used: kfree(mode_option_buf); while name is still accessed by: if ((name_matches(db[i], name, namelen) || Since name aliases mode_option_buf, this may result in a use-after-free. Fix this by extending the lifetime of mode_option_buf until the end of the function by using scope-based resource management for cleanup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-08-17

Generated

2026-09-03

AI Q&A

2026-07-24

EPSS Evaluated

2026-09-01

NVD

CVE-2026-64245

EUVD

EUVD-2026-48654

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.7 (inc) to 6.12.95 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.38 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.3 (exc)
linux	linux_kernel	From 6.4 (inc) to 6.6.144 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's fbdev subsystem. It occurs when mode_option_buf is freed but a pointer to it (name) is still accessed later in the code. The issue stems from mode_option being assigned from mode_option_buf when mode_option is NULL, but mode_option_buf is freed before name is no longer used.

Detection Guidance

This vulnerability is specific to the Linux kernel's fbdev subsystem and requires kernel-level detection. It cannot be detected via network scanning or standard commands. Check kernel logs for crashes or unusual behavior in framebuffer operations. Use 'dmesg | grep -i fb' to inspect framebuffer-related errors.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by triggering the use-after-free condition. It may lead to system crashes, data corruption, or privilege escalation if exploited.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's fbdev subsystem. It does not directly relate to data privacy or security controls required by GDPR or HIPAA. Compliance impact would depend on whether this flaw could be exploited to access or manipulate sensitive data, but no evidence suggests such a connection.

Mitigation Strategies

Apply the latest kernel patch from your Linux distribution to fix the use-after-free in fb_find_mode(). If patching is not immediately possible, disable the vulnerable framebuffer subsystem by blacklisting the fbdev module or restricting access to framebuffer devices.

Hi! I’m here to help you understand CVE-2026-64245. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70