CVE-2026-53401

In the Linux kernel, the following vulnerability has been resolved:

fbdev: omap2: fix use-after-free in omapfb_mmap

omapfbmmap() has a race condition with OMAPFBSETUP_PLANE ioctl that can lead to use-after-free:

The fbmmap() entry point holds mmlock but not lock (fbinfo->lock), while ioctl handlers like OMAPFBSETUPPLANE hold lock but not mmlock. This allows concurrent execution.

In omapfbmmap(): 1. rg = omapfbgetmemregion(ofbi->region); // Get old region ref 2. start = omapfbgetregionpaddr(ofbi); // Read from NEW region 3. len = fix->smemlen; // Read from NEW region 4. vmiomapmemory(vma, start, len); // Map NEW region memory 5. atomicinc(&rg->mapcount); // Increment OLD region!

Concurrently, OMAPFBSETUPPLANE can: - Reassign ofbi->region = newrg - Update fix->smemlen - OMAPFBSETUPMEM then checks NEW region's map_count (0!) and frees it

This leaves userspace with a mapping to freed physical memory.

The fix is to read all required values (start, len) from the same region reference (rg) that will have its map_count incremented, preventing the region from being freed while still mapped.