In the Linux kernel, the following vulnerability has been resolved:
fbdev: fix use-after-free in store_modes()
storemodes() replaces a framebuffer's modelist with modes from userspace. On success it frees the old modelist with fbdestroy_modelist(). Two fields still point into that freed list.
One pointer is fbdisplay[i].mode, the mode a console is using. fbconnewmodelist() moves these pointers to the new list. It only does so for consoles still mapped to the framebuffer. An unmapped console is skipped and keeps its stale pointer. Unbinding fbcon, for example, sets con2fbmap[i] to -1 but leaves fbdisplay[i].mode set. An FBIOPUTVSCREENINFO ioctl with FBACTIVATEINVMODE later reaches fbconmodedeleted(). That function reads the stale fbdisplay[i].mode through fbmodeis_equal(). The read is a use-after-free.
The other pointer is fbinfo->mode, the current mode. It is set through the mode sysfs attribute. storemodes() does not update fbinfo->mode, so it is left pointing into the freed list. showmode(), the attribute's read handler, dereferences the stale fbinfo->mode through modestring(). The read is a use-after-free.
Clear both pointers before freeing the list. Commit a1f305893074 ("fbcon: Set fbdisplay[i]->mode to NULL when the mode is released") added the helper fbcondeletemodelist(). It clears every fbdisplay[i].mode that points into a given list. So far it is called only from the unregister path. Call it from storemodes() too, and set fbinfo->mode to NULL.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63826.json",
"cna_assigner": "Linux"
}