CVE-2026-97604fbdev: vfb: defer cleanup until the last reference
- —Not scoredno CVSS score yet
- 0.21%Exploitation in 30 daysEPSS · top 89% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: vfb: defer cleanup until the last reference FBIOGETCMAP takes a shallow snapshot of info->cmap and performs the usercopy after dropping info->lock. vfb_remove() frees the colormap immediately after unregistering the framebuffer, even when an open file still holds a reference to fb_info. A concurrent driver unbind can therefore free the colormap while the ioctl copies it to userspace. KASAN reports: BUG: KASAN: slab-use-after-free in _copy_to_user Read of size 512 by task poc/125 _copy_to_user (./include/linux/instrumented.h:129 ./include/linux/uaccess.h:201 lib/usercopy.c:24) fb_cmap_to_user (./include/linux/uaccess.h:230 drivers/video/fbdev/core/fbcmap.c:211) do_fb_ioctl (drivers/video/fbdev/core/fb_chrdev.c:114) Allocated by task 1: fb_alloc_cmap_gfp (./include/linux/slab.h:973 ./include/linux/slab.h:1290 drivers/video/fbdev/core/fbcmap.c:108) vfb_probe (drivers/video/fbdev/vfb.c:459) Freed by task 124: fb_dealloc_cmap (drivers/video/fbdev/core/fbcmap.c:151) vfb_remove (drivers/video/fbdev/vfb.c:489) unregister_framebuffer() drops the registration reference, and fbdev calls fb_destroy after the last put_fb_info(). Move the registered framebuffer's cleanup into an fb_destroy callback so its colormap and screen buffer stay alive until all file references have been released.
Timeline
ID reserved
By Linux
- 1 day later
· 1 day later
Published
- 24 days later
· 24 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.21% · top 89% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a – < bf49eac7ed11aabd0b9b790c062742a8e4be97c6
- affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a – < 040ce3950f64a11e9ee5646c8aaa91fd2e29e245
- affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a – < ab664e279eb2a68e55895dd115a9488807280f07
- affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a – < de5a0eda59fe4b3eacd1a67c992e54766bb6683f
- affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a – < 86356f13598f59f5acb1754895747dcdaf65a254
- affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a – < 5ff1effb047e465cde193d7df95988aa1520035e
- affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a – < 3c91e51a53cf805e551e5dc8149cd0539a6dbb9d
- affected 5e266e2e0e19532c1b8e2e2bff1eb6ccf42e478a – < a0a34a40ed299c9c7cff6af163a5b883ee9d6d73
- affected 2.6.30
- unaffected < 2.6.30
- unaffected 5.10.271 – ≤ 5.10.*
- unaffected 5.15.222 – ≤ 5.15.*
- unaffected 6.1.189 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.111 – ≤ 6.12.*
- unaffected 6.18.53 – ≤ 6.18.*
- unaffected 7.2.7 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/bf49eac7ed11aabd0b9b790c062742a8e4be97c6 (opens in a new tab)
- https://git.kernel.org/stable/c/040ce3950f64a11e9ee5646c8aaa91fd2e29e245 (opens in a new tab)
- https://git.kernel.org/stable/c/ab664e279eb2a68e55895dd115a9488807280f07 (opens in a new tab)
- https://git.kernel.org/stable/c/de5a0eda59fe4b3eacd1a67c992e54766bb6683f (opens in a new tab)
- https://git.kernel.org/stable/c/86356f13598f59f5acb1754895747dcdaf65a254 (opens in a new tab)
- https://git.kernel.org/stable/c/5ff1effb047e465cde193d7df95988aa1520035e (opens in a new tab)
- https://git.kernel.org/stable/c/3c91e51a53cf805e551e5dc8149cd0539a6dbb9d (opens in a new tab)
- https://git.kernel.org/stable/c/a0a34a40ed299c9c7cff6af163a5b883ee9d6d73 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-86735 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-97604)Record last updated .