Use-After-Free Vulnerability in Linux Kernel fbdev Component

CVE-2026-63826

What is CVE-2026-63826?

A critical issue has been identified in the Linux kernel's framebuffer device (fbdev) that exposes it to a use-after-free vulnerability. When the store_modes() function is executed, it replaces the framebuffer's modelist with new modes obtained from userspace. Upon successful execution, it invalidates the old modelist via fb_destroy_modelist(), but critical pointers remain pointing to this freed memory. Two significant pointers are affected: fb_display[i].mode, which is utilized by console applications, and fb_info->mode, the current mode of the framebuffer. If a console becomes unmapped or is unbound, these pointers can retain references to outdated information leading to potential system instability and security threats when exploited. It is important to apply the proposed fixes to safely manage memory usage and avoid these vulnerabilities.

References