Executive brief
A vulnerability exists in the Linux kernel's framebuffer console (fbcon) component, which manages how text and graphics are displayed on the system console. An attacker with local access could exploit this flaw to cause a system crash or potentially execute unauthorized code by manipulating display settings. This could lead to a complete loss of system availability or unauthorized access to sensitive data.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's framebuffer console (fbcon) driver. During the unregistration of a framebuffer device, the memory associated with the video mode list (fb_info->modelist) is freed, but pointers to these modes in the global fb_display array are not cleared. A local attacker can trigger this UAF by registering a secondary framebuffer device, assigning its mode to a console, unregistering the device (e.g., via module unloading), and then performing subsequent ioctl operations (like FBIOPUT_CON2FBMAP or mode deletion) that access the now-freed memory. The fix involves updating do_unregister_framebuffer() to call a new helper, fbcon_delete_modelist(), which nullifies stale pointers in the fb_display array.
Affected products
- Linux Linux 2.6.12 to 5.15.203, 6.1.159, 6.6.117, 6.12.58, 6.17.8
Timeline
- 2025-12-08: advisory: CVE-2025-40323 published
- 2025-11-24: patched: Fix committed to stable branches
References
- https://git.kernel.org/stable/c/39c2c1a2773aaf73e56906e5ef670114eb2d354f
- https://git.kernel.org/stable/c/468f78276a37f4c6499385a4ce28f4f57be6655d
- https://git.kernel.org/stable/c/4ac18f0e6a6d599ca751c4cd98e522afc8e3d4eb
- https://git.kernel.org/stable/c/a1f3058930745d2b938b6b4f5bd9630dc74b26b7
- https://git.kernel.org/stable/c/c079d42f70109512eee49123a843be91d8fa133f
- https://git.kernel.org/stable/c/de89d19f4f30d9a8de87b9d08c1bd35cb70576d8