CVE-2026-63826

The CVE-2026-63826 issue affects the Linux kernel fbdev path, where store_modes() frees a framebuffer modelist but leaves stale pointers in fb_display[i].mode and fb_info->mode. The root cause is use-after-free reads when fbcon_mode_deleted() and show_mode() dereference these pointers after fb...

CVE-2026-63826 fbdev: fix use-after-free in store_modes()

In the Linux kernel, the following vulnerability has been resolved: fbdev: fix use-after-free in storemodes storemodes replaces a framebuffer's modelist with modes from userspace. On success it frees the old modelist with fbdestroymodelist. Two fields still point into that freed list. One pointer...

CVE-2026-53403

The CVE-2026-53403 issue affects the Linux kernel fbdev path: after store_modes() replaces the modelist, info->var may no longer have a matching entry, leading fb_videomode_to_var() to dereference a NULL mode during later console takeovers. The fix keeps the current mode in the modelist in fb_...

CVE-2026-53401

In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfbmmap omapfbmmap has a race condition with OMAPFBSETUPPLANE ioctl that can lead to use-after-free: The fbmmap entry point holds mmlock but not lock fbinfo-lock, while ioctl handlers like...

CVE-2026-53402 fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds read in errout of fbcondosetfont When fbcondosetfont fails e.g., due to a memory allocation failure inside vcresize under heavy memory pressure, it jumps to the errout label to roll back the consol...

Linux Distros Unpatched Vulnerability : CVE-2026-53402

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: fbcon: fix out-of-bounds read in errout of fbcondosetfont When fbcondosetfont fails e.g., due to a memory allocation failure inside vcresize under heavy...

Linux Distros Unpatched Vulnerability : CVE-2026-53401

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: omap2: fix use-after-free in omapfbmmap omapfbmmap has a race condition with OMAPFBSETUPPLANE ioctl that can lead to use-after-free: The fbmmap entry...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: fbdev: smscufx – The data passed through ioctl is copied to the kernel’s space properly. The UFXIOCTLREPORTDAMAGE ioctl does not copy data from user space to the kernel’s space properly. Instead, it directly references the memory...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: fbdev: rivafb: fixed a divide error in nv3arb A userspace program can trigger the RIVA NV3 arbitration code by calling the FBIOPUTVSCREENINFO ioctl on /dev/fb. When doing so, the driver recomputes FIFO arbitration parameters in...

Siemens RUGGEDCOM RST2428P Improper Input Validation (CVE-2026-23236)

In the Linux kernel, the following vulnerability has been resolved: fbdev: smscufx: properly copy ioctl memory to kernelspace The UFXIOCTLREPORTDAMAGE ioctl does not properly copy data from userspace to kernelspace, and instead directly references the memory, which can cause problems if invalid...

SUSE CVE-2026-45954

In the Linux kernel, the following vulnerability has been resolved: fbdev: au1200fb: Fix a memory leak in au1200fbdrvprobe In au1200fbdrvprobe, when platformgetirq fails, it directly returns from the function with an error code, which causes a memory leak. Replace it with a goto label to ensure...

SUSE CVE-2026-46065

In the Linux kernel, the following vulnerability has been resolved: fbdev: defio: Disconnect deferred I/O from the lifetime of struct fbinfo Hold state of deferred I/O in struct fbdeferrediostate. Allocate an instance as part of initializing deferred I/O and remove it only after the final mapping...

UBUNTU-CVE-2026-45954

In the Linux kernel, the following vulnerability has been resolved: fbdev: au1200fb: Fix a memory leak in au1200fbdrvprobe In au1200fbdrvprobe, when platformgetirq fails, it directly returns from the function with an error code, which causes a memory leak. Replace it with a goto label to ensure...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the delay in I/O operations within the fbdev defio module, where the lifecycle of the struct fbin...

Linux Distros Unpatched Vulnerability : CVE-2026-46065

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fbinfo Hold state of deferred I/O in struct fbdeferrediostate. Allocate an instance as part of...

CVE-2026-43497

In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: add vmops to dlfbopsmmap to prevent use-after-free dlfbopsmmap uses remappfnrange to map vmalloc framebuffer pages to userspace but sets no vmops on the VMA. This means the kernel cannot track active mmaps. When...

EUVD-2026-31273

In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: add vmops to dlfbopsmmap to prevent use-after-free dlfbopsmmap uses remappfnrange to map vmalloc framebuffer pages to userspace but sets no vmops on the VMA. This means the kernel cannot track active mmaps. When...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: i740fb: Check the argument of i740calcvclk Since the user can control the arguments of the ioctl function from the user space, special arguments may lead to a divide-by-zero bug. If the user provides an improper...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fixed invalid page access after closing deferred I/O devices. When a fbdev with deferred I/O is opened and closed, the dirty pages still remain in the pageref list. Eventually, those pages may be processed during the delay...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: Release the buffer when fbcondosetfont fails. syzbot is reporting a memory leak at fbcondosetfont, for the commit a5a923038d70 “fbdev: fbcon: Properly revert changes when vcresize fails”. It was overlooked that the...