CVE-2026-43497
fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages to userspace but sets no vm_ops on the VMA. This means the kernel cannot track active mmaps. When dlfb_realloc_framebuffer() replaces the backing buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated. On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages while userspace PTEs still reference them, resulting in a use-after-free: the process retains read/write access to freed kernel pages. Add vm_operations_struct with open/close callbacks that maintain an atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(), check mmap_count and return -EBUSY if the buffer is currently mapped, preventing buffer replacement while userspace holds stale PTEs. Tested with PoC using dummy_hcd + raw_gadget USB device emulation.
INFO
Published Date :
May 21, 2026, 1:16 p.m.
Last Modified :
July 23, 2026, 4:10 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Add vm_operations_struct with open/close callbacks.
- Maintain an atomic mmap_count on struct dlfb_data.
- Check mmap_count before reallocating framebuffer.
- Return -EBUSY if buffer is currently mapped.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-43497.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-43497 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-43497
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-43497 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-43497 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: el kernel de Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: fbdev: udlfb: añadir vm_ops a dlfb_ops_mmap para prevenir el uso después de liberación dlfb_ops_mmap() utiliza remap_pfn_range() para mapear páginas de framebuffer de vmalloc al espacio de usuario, pero no establece vm_ops en el VMA. Esto significa que el kernel no puede rastrear mmaps activos. Cuando dlfb_realloc_framebuffer() reemplaza el búfer de respaldo a través de FBIOPUT_VSCREENINFO, los PTEs de mmap existentes no se invalidan. Al desconectar el USB, dlfb_ops_destroy() llama a vfree() en las páginas antiguas mientras los PTEs del espacio de usuario aún las referencian, lo que resulta en un uso después de liberación: el proceso retiene acceso de lectura/escritura a páginas del kernel liberadas. Añadir vm_operations_struct con callbacks de apertura/cierre que mantienen un mmap_count atómico en la estructura dlfb_data. En dlfb_realloc_framebuffer(), comprobar mmap_count y devolver -EBUSY si el búfer está actualmente mapeado, lo que previene el reemplazo del búfer mientras el espacio de usuario mantiene PTEs obsoletos. Probado con PoC utilizando emulación de dispositivo USB dummy_hcd + raw_gadget. -
Initial Analysis by [email protected]
Jun. 26, 2026
Action Type Old Value New Value Added CWE CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.30 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.7 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.88 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.140 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.19 up to (excluding) 5.10.258 Added Reference Type kernel.org: https://git.kernel.org/stable/c/18dd358de72d57993422cbb5dfb29ccd74efe192 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4f312c30f0368e8d2a76aa650dff73f23490b5e7 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/5931f5651ee32bd41b3323256b31fcc8e71336ed Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/60f711cfd580f86fea8284146ac133804e728f9a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/8de779dc40d35d39fa07387b6f921eb11df0f511 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a2c53a3822ee26e8d758071815b9ed3bf6669fc1 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/da9b065cedfd3b574f229d5be594e6aa47a27ae6 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e3d9865dacd7435b8465848428210d0f0c673311 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '7433914efd584b22bb49d3e1eee001f5d0525ecd', 'lessThan': '60f711cfd580f86fea8284146ac133804e728f9a', 'versionType': 'git'}, {'status': 'affected', 'version': '7433914efd584b22bb49d3e1eee001f5d0525ecd', 'lessThan': '5931f5651ee32bd41b3323256b31fcc8e71336ed', 'versionType': 'git'}, {'status': 'affected', 'version': '7433914efd584b22bb49d3e1eee001f5d0525ecd', 'lessThan': 'e3d9865dacd7435b8465848428210d0f0c673311', 'versionType': 'git'}, {'status': 'affected', 'version': '7433914efd584b22bb49d3e1eee001f5d0525ecd', 'lessThan': '4f312c30f0368e8d2a76aa650dff73f23490b5e7', 'versionType': 'git'}, {'status': 'affected', 'version': '7433914efd584b22bb49d3e1eee001f5d0525ecd', 'lessThan': '18dd358de72d57993422cbb5dfb29ccd74efe192', 'versionType': 'git'}, {'status': 'affected', 'version': '7433914efd584b22bb49d3e1eee001f5d0525ecd', 'lessThan': 'da9b065cedfd3b574f229d5be594e6aa47a27ae6', 'versionType': 'git'}, {'status': 'affected', 'version': '7433914efd584b22bb49d3e1eee001f5d0525ecd', 'lessThan': 'a2c53a3822ee26e8d758071815b9ed3bf6669fc1', 'versionType': 'git'}, {'status': 'affected', 'version': '7433914efd584b22bb49d3e1eee001f5d0525ecd', 'lessThan': '8de779dc40d35d39fa07387b6f921eb11df0f511', 'versionType': 'git'}], 'programFiles': ['drivers/video/fbdev/udlfb.c', 'include/video/udlfb.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.140', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.88', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.30', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.7', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/video/fbdev/udlfb.c', 'include/video/udlfb.h'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 01, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/5931f5651ee32bd41b3323256b31fcc8e71336ed Added Reference https://git.kernel.org/stable/c/60f711cfd580f86fea8284146ac133804e728f9a Added Reference https://git.kernel.org/stable/c/e3d9865dacd7435b8465848428210d0f0c673311 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 30, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 21, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages to userspace but sets no vm_ops on the VMA. This means the kernel cannot track active mmaps. When dlfb_realloc_framebuffer() replaces the backing buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated. On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages while userspace PTEs still reference them, resulting in a use-after-free: the process retains read/write access to freed kernel pages. Add vm_operations_struct with open/close callbacks that maintain an atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(), check mmap_count and return -EBUSY if the buffer is currently mapped, preventing buffer replacement while userspace holds stale PTEs. Tested with PoC using dummy_hcd + raw_gadget USB device emulation. Added Reference https://git.kernel.org/stable/c/18dd358de72d57993422cbb5dfb29ccd74efe192 Added Reference https://git.kernel.org/stable/c/4f312c30f0368e8d2a76aa650dff73f23490b5e7 Added Reference https://git.kernel.org/stable/c/8de779dc40d35d39fa07387b6f921eb11df0f511 Added Reference https://git.kernel.org/stable/c/a2c53a3822ee26e8d758071815b9ed3bf6669fc1 Added Reference https://git.kernel.org/stable/c/da9b065cedfd3b574f229d5be594e6aa47a27ae6