CVE-2026-23236

Vulnerability

Overview

The Linux kernel's smscufx framebuffer driver contains a vulnerability in the UFX_IOCTL_REPORT_DAMAGE ioctl handler`. The ioctl does not properly copy data from userspace to kernelspace; instead, it directly references the user-supplied memory. This can lead to issues if invalid or malicious data is passed from userspace, potentially causing memory corruption or other undefined behavior [1].

Exploitation

An attacker with local access and the ability to invoke the UFX_IOCTL_REPORT_DAMAGE ioctl on a smscufx device can exploit this flaw. By crafting a malicious userspace buffer, the attacker can trigger the kernel to operate on untrusted data without proper validation or copying, which may lead to kernel memory corruption [2].

Impact

Successful exploitation could allow an attacker to corrupt kernel memory, potentially leading to a denial of service (system crash) or, in more severe cases, privilege escalation. The vulnerability is rated High with a CVSS v3 score of 7.3, reflecting the potential for significant impact on system integrity and availability [3].

Mitigation

The fix involves correctly copying the userspace memory to kernelspace before accessing it, ensuring that the kernel operates on a validated copy. The patch has been applied to the Linux kernel stable tree and is available in commits such as 6167af934f95 and 1c008ad0f0d1 [4]. Users are advised to update their kernels to include this patched version.