CVE-2026-64245
Received Received - Intake

Use-After-Free in Linux Kernel fbdev modedb

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible UAF in fb_find_mode() If mode_option is NULL, it is assigned from mode_option_buf: if (!mode_option) { fb_get_options(NULL, &mode_option_buf); mode_option = mode_option_buf; } Later, name is assigned from mode_option: const char *name = mode_option; However, mode_option_buf is freed before name is no longer used: kfree(mode_option_buf); while name is still accessed by: if ((name_matches(db[i], name, namelen) || Since name aliases mode_option_buf, this may result in a use-after-free. Fix this by extending the lifetime of mode_option_buf until the end of the function by using scope-based resource management for cleanup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64245
EUVD
EUVD-2026-48654

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux_kernel linux_kernel *
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's fbdev subsystem. It occurs when mode_option_buf is freed but a pointer to it (name) is still accessed later in the code. The issue stems from mode_option being assigned from mode_option_buf when mode_option is NULL, but mode_option_buf is freed before name is no longer used.

Detection Guidance

This vulnerability is specific to the Linux kernel's fbdev subsystem and requires kernel-level detection. It cannot be detected via network scanning or standard commands. Check kernel logs for crashes or unusual behavior in framebuffer operations. Use 'dmesg | grep -i fb' to inspect framebuffer-related errors.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by triggering the use-after-free condition. It may lead to system crashes, data corruption, or privilege escalation if exploited.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's fbdev subsystem. It does not directly relate to data privacy or security controls required by GDPR or HIPAA. Compliance impact would depend on whether this flaw could be exploited to access or manipulate sensitive data, but no evidence suggests such a connection.

Mitigation Strategies

Apply the latest kernel patch from your Linux distribution to fix the use-after-free in fb_find_mode(). If patching is not immediately possible, disable the vulnerable framebuffer subsystem by blacklisting the fbdev module or restricting access to framebuffer devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64245. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart