Use-After-Free Vulnerability in Linux Kernel Affecting fbdev Module

CVE-2026-64245

What is CVE-2026-64245?

A use-after-free vulnerability exists in the fbdev module of the Linux kernel, specifically in the function fb_find_mode(). This issue arises when a NULL value for mode_option is replaced by mode_option_buf, which is freed before it is completely utilized. As a result, the variable name can still access the deallocated memory, potentially leading to unexpected behavior or system instability. To mitigate this vulnerability, the solution involves extending the lifetime of mode_option_buf until its last use by implementing scope-based resource management.

References