CVE-2026-97604

Received Received - Intake

Use-After-Free in Linux Kernel Virtual Frame Buffer

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fbdev: vfb: defer cleanup until the last reference FBIOGETCMAP takes a shallow snapshot of info->cmap and performs the usercopy after dropping info->lock. vfb_remove() frees the colormap immediately after unregistering the framebuffer, even when an open file still holds a reference to fb_info. A concurrent driver unbind can therefore free the colormap while the ioctl copies it to userspace. KASAN reports: BUG: KASAN: slab-use-after-free in _copy_to_user Read of size 512 by task poc/125 _copy_to_user (./include/linux/instrumented.h:129 ./include/linux/uaccess.h:201 lib/usercopy.c:24) fb_cmap_to_user (./include/linux/uaccess.h:230 drivers/video/fbdev/core/fbcmap.c:211) do_fb_ioctl (drivers/video/fbdev/core/fb_chrdev.c:114) Allocated by task 1: fb_alloc_cmap_gfp (./include/linux/slab.h:973 ./include/linux/slab.h:1290 drivers/video/fbdev/core/fbcmap.c:108) vfb_probe (drivers/video/fbdev/vfb.c:459) Freed by task 124: fb_dealloc_cmap (drivers/video/fbdev/core/fbcmap.c:151) vfb_remove (drivers/video/fbdev/vfb.c:489) unregister_framebuffer() drops the registration reference, and fbdev calls fb_destroy after the last put_fb_info(). Move the registered framebuffer's cleanup into an fb_destroy callback so its colormap and screen buffer stay alive until all file references have been released.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97604

EUVD

EUVD-2026-86735

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the framebuffer video subsystem. The problem occurs when FBIOGETCMAP ioctl copies a colormap to userspace after the framebuffer device has been removed. The cleanup of the colormap happens too early, while a file descriptor still holds a reference to the framebuffer, leading to a use-after-free condition that can cause memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's virtual framebuffer (vfb) driver and requires kernel-level detection. Check if the vfb module is loaded using 'lsmod | grep vfb'. Monitor kernel logs for slab-use-after-free errors with 'dmesg | grep -i "slab-use-after-free"'. If you suspect exploitation, look for concurrent driver unbind operations during FBIOGETCMAP ioctl calls.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a kernel crash or memory corruption by exploiting the race condition between framebuffer removal and colormap access. This may lead to denial-of-service conditions or potentially enable further exploitation depending on the system configuration.

Compliance Impact

This vulnerability involves a use-after-free condition in the Linux kernel's framebuffer driver, which could lead to memory corruption or crashes. It does not directly relate to data privacy or security controls required by standards like GDPR or HIPAA, which focus on unauthorized data access or disclosure.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this issue. If immediate patching is not possible, consider unloading the vfb module with 'modprobe -r vfb' if it is not required for your system. Monitor for signs of exploitation in kernel logs.

Hi! I’m here to help you understand CVE-2026-97604. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70