Junglewise Threat Intelligence

CVE-2026-23236: Linux Kernel smscufx improper memory handling in ioctl

CVE-2026-23236 · Severity: high · CVSS 7.3 · Published 2026-03-04

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's SMSC UFX graphics driver. The software fails to safely handle data sent from user applications to the kernel, which could allow a local attacker to cause a system crash or potentially gain unauthorized access to system memory. This affects systems using specific SMSC USB display adapters.

Technical details

A vulnerability exists in the fbdev smscufx driver within the Linux kernel. The UFX_IOCTL_REPORT_DAMAGE ioctl implementation directly references userspace memory instead of using copy_from_user() to bring the data into kernelspace. This lack of proper memory isolation allows a local user with access to the device to pass invalid or malicious data structures that the kernel then processes as trusted. This can result in a kernel oops, denial of service, or potential information disclosure/privilege escalation. The issue has been resolved by implementing proper kmalloc and copy_from_user logic in drivers/video/fbdev/smscufx.c.

Affected products

  • Linux Linux Kernel 3.2 to 5.10.251, 5.11 to 5.15.201, 5.16 to 6.1.164, 6.2 to 6.6.127, 6.7 to 6.12.74, 6.13 to 6.18.13, 6.19 to 6.19.3

Timeline

  • 2025-12-28: other: Patch authored
  • 2026-03-04: disclosed: CVE published
  • 2026-03-04: advisory

References

Related threats