Executive brief
The sm501fb driver in the Linux kernel, which manages Silicon Motion SM501 graphics card framebuffer operations, contains memory management bugs (use-after-free, buffer overruns, and memory leaks) in its device tree binding code. An attacker with local access could potentially exploit these flaws to crash the system or execute arbitrary code with kernel privileges.
Technical details
The vulnerability exists in the sm501fb framebuffer driver's device tree (OF) binding probe code. Three distinct memory safety issues are present: (1) use-after-free where info->edid_data is accessed and freed twice when both CRT and PANEL are enabled; (2) buffer overrun from an unsafe strcpy() that overwrites a fixed-size buffer with an unconstrained string from of_get_property() without checking the returned length; (3) memory leaks where info->edid_data and the mode string are not freed in error paths or after successful probe completion. The fix replaces unsafe strcpy() with kstrdup() for proper allocation and adds explicit kfree() calls in success and error code paths. Local access to trigger device tree binding (e.g., via device hotplug or module load) is required; no network vector exists.
Affected products
- Linux Linux kernel multiple versions across 2.6.11 through 6.9 and later
Timeline
- 2026-08-15: disclosed
- 2026-06-08: patched: Upstream fix committed; stable backports followed