CVE-2026-97604
Received Received - Intake

Use-After-Free in Linux Kernel Virtual Frame Buffer

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: vfb: defer cleanup until the last reference FBIOGETCMAP takes a shallow snapshot of info->cmap and performs the usercopy after dropping info->lock. vfb_remove() frees the colormap immediately after unregistering the framebuffer, even when an open file still holds a reference to fb_info. A concurrent driver unbind can therefore free the colormap while the ioctl copies it to userspace. KASAN reports: BUG: KASAN: slab-use-after-free in _copy_to_user Read of size 512 by task poc/125 _copy_to_user (./include/linux/instrumented.h:129 ./include/linux/uaccess.h:201 lib/usercopy.c:24) fb_cmap_to_user (./include/linux/uaccess.h:230 drivers/video/fbdev/core/fbcmap.c:211) do_fb_ioctl (drivers/video/fbdev/core/fb_chrdev.c:114) Allocated by task 1: fb_alloc_cmap_gfp (./include/linux/slab.h:973 ./include/linux/slab.h:1290 drivers/video/fbdev/core/fbcmap.c:108) vfb_probe (drivers/video/fbdev/vfb.c:459) Freed by task 124: fb_dealloc_cmap (drivers/video/fbdev/core/fbcmap.c:151) vfb_remove (drivers/video/fbdev/vfb.c:489) unregister_framebuffer() drops the registration reference, and fbdev calls fb_destroy after the last put_fb_info(). Move the registered framebuffer's cleanup into an fb_destroy callback so its colormap and screen buffer stay alive until all file references have been released.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97604
EUVD
EUVD-2026-86735

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the framebuffer video subsystem. The problem occurs when FBIOGETCMAP ioctl copies a colormap to userspace after the framebuffer device has been removed. The cleanup of the colormap happens too early, while a file descriptor still holds a reference to the framebuffer, leading to a use-after-free condition that can cause memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's virtual framebuffer (vfb) driver and requires kernel-level detection. Check if the vfb module is loaded using 'lsmod | grep vfb'. Monitor kernel logs for slab-use-after-free errors with 'dmesg | grep -i "slab-use-after-free"'. If you suspect exploitation, look for concurrent driver unbind operations during FBIOGETCMAP ioctl calls.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a kernel crash or memory corruption by exploiting the race condition between framebuffer removal and colormap access. This may lead to denial-of-service conditions or potentially enable further exploitation depending on the system configuration.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this issue. If immediate patching is not possible, consider unloading the vfb module with 'modprobe -r vfb' if it is not required for your system. Monitor for signs of exploitation in kernel logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97604. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart