Use-After-Free Vulnerability in Linux Kernel Affects OMAPFB Driver

CVE-2026-53401

What is CVE-2026-53401?

A vulnerability in the Linux kernel's OMAPFB driver leads to a use-after-free condition due to improper locking mechanisms in the fbdev subsystem. The issue arises from a race condition between the omapfb_mmap() function and the OMAPFB_SETUP_PLANE ioctl handler. While omapfb_mmap() holds the mm_lock, the ioctl operations manage the fb_info->lock, enabling concurrent executions that can mistakenly free a physical memory region still mapped to userspace. The defect can be exploited when a new memory region is assigned, potentially leaving access to freed memory, which poses serious security risks. The resolution involves ensuring that memory reads are consistent and that references are appropriately managed to avoid access to freed addresses.

References