Use After Free Vulnerability in Linux Kernel Affecting Framebuffer Devices

CVE-2025-40323

What is CVE-2025-40323?

In the Linux kernel, a use after free vulnerability exists due to improper handling of framebuffer modes during unregistration. When a framebuffer device is unregistered, the memory allocated for its mode list is freed, but the corresponding pointers in the global fb_display array remain unchanged, resulting in dangling pointers. This issue can be exploited through system calls that attempt to access freed modes, leading to potential system crashes and unpredictable behavior. Implementing a check within the do_unregister_framebuffer() function can prevent this vulnerability by ensuring freed modes are set to NULL in the fb_display array.

References