{"id":"CVE-2026-97604","revision":"c29cc8fb46d047f78c8a57145f2f4847","records":[{"revision":"c29cc8fb46d047f78c8a57145f2f4847","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-97604","aliases":[],"title":"fbdev: vfb: defer cleanup until the last reference","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: vfb: defer cleanup until the last reference\n\nFBIOGETCMAP takes a shallow snapshot of info->cmap and performs the\nusercopy after dropping info->lock. vfb_remove() frees the colormap\nimmediately after unregistering the framebuffer, even when an open file\nstill holds a reference to fb_info. A concurrent driver unbind can\ntherefore free the colormap while the ioctl copies it to userspace.\n\nKASAN reports:\n\n  BUG: KASAN: slab-use-after-free in _copy_to_user\n  Read of size 512 by task poc/125\n\n   _copy_to_user (./include/linux/instrumented.h:129 ./include/linux/uaccess.h:201 lib/usercopy.c:24)\n   fb_cmap_to_user (./include/linux/uaccess.h:230 drivers/video/fbdev/core/fbcmap.c:211)\n   do_fb_ioctl (drivers/video/fbdev/core/fb_chrdev.c:114)\n\n   Allocated by task 1:\n   fb_alloc_cmap_gfp (./include/linux/slab.h:973 ./include/linux/slab.h:1290 drivers/video/fbdev/core/fbcmap.c:108)\n   vfb_probe (drivers/video/fbdev/vfb.c:459)\n\n   Freed by task 124:\n   fb_dealloc_cmap (drivers/video/fbdev/core/fbcmap.c:151)\n   vfb_remove (drivers/video/fbdev/vfb.c:489)\n\nunregister_framebuffer() drops the registration reference, and fbdev calls\nfb_destroy after the last put_fb_info(). Move the registered framebuffer's\ncleanup into an fb_destroy callback so its colormap and screen buffer stay\nalive until all file references have been released.","state":0,"publishedAt":"2026-09-25T10:22:16.613+00:00","modifiedAt":"2026-10-19T09:10:08.19+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/video/fbdev/vfb.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a\",\n                            \"lessThan\": \"bf49eac7ed11aabd0b9b790c062742a8e4be97c6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a\",\n                            \"lessThan\": \"040ce3950f64a11e9ee5646c8aaa91fd2e29e245\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a\",\n                            \"lessThan\": \"ab664e279eb2a68e55895dd115a9488807280f07\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a\",\n                            \"lessThan\": \"de5a0eda59fe4b3eacd1a67c992e54766bb6683f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a\",\n                            \"lessThan\": \"86356f13598f59f5acb1754895747dcdaf65a254\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a\",\n                            \"lessThan\": \"5ff1effb047e465cde193d7df95988aa1520035e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a\",\n                            \"lessThan\": \"3c91e51a53cf805e551e5dc8149cd0539a6dbb9d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a\",\n                            \"lessThan\": \"a0a34a40ed299c9c7cff6af163a5b883ee9d6d73\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/video/fbdev/vfb.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.30\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.30\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/bf49eac7ed11aabd0b9b790c062742a8e4be97c6","https://git.kernel.org/stable/c/040ce3950f64a11e9ee5646c8aaa91fd2e29e245","https://git.kernel.org/stable/c/ab664e279eb2a68e55895dd115a9488807280f07","https://git.kernel.org/stable/c/de5a0eda59fe4b3eacd1a67c992e54766bb6683f","https://git.kernel.org/stable/c/86356f13598f59f5acb1754895747dcdaf65a254","https://git.kernel.org/stable/c/5ff1effb047e465cde193d7df95988aa1520035e","https://git.kernel.org/stable/c/3c91e51a53cf805e551e5dc8149cd0539a6dbb9d","https://git.kernel.org/stable/c/a0a34a40ed299c9c7cff6af163a5b883ee9d6d73"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97604","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97604","identifiers":["CVE-2026-97604"]},"retained":false,"historicalAffected":[]}],"coverage":[]}