CVE-2026-43497

Vulnerability

The Linux kernel's udlfb framebuffer driver (drivers/video/fbdev/udlfb.c) contains a use-after-free vulnerability due to missing vm_operations_struct (vm_ops) on VMAs created by dlfb_ops_mmap(). The function uses remap_pfn_range() to map vmalloc-allocated framebuffer pages to userspace without setting vm_ops, so the kernel cannot track active mmaps. When dlfb_realloc_framebuffer() is triggered via FBIOPUT_VSCREENINFO ioctl, the backing buffer is freed and replaced without invalidating existing userspace PTEs. On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages while userspace processes still hold references via stale PTEs, leading to a use-after-free condition. The vulnerability exists in all kernel versions containing the affected code; the fix is deployed in stable kernels after commit 4f312c30f0368e8d2a76aa650dff73f23490b5e7 [1][2].

Exploitation

An attacker needs local access to the system with the ability to open the /dev/fb* device and perform mmap() to map the framebuffer into userspace. Additionally, the attacker must be able to trigger a framebuffer reallocation via FBIOPUT_VSCREENINFO ioctl or cause a USB disconnect of the DisplayLink device. The attack does not require special privileges beyond read/write access to the framebuffer device (typically granted to the user logged in at the console or via group membership). After mapping the framebuffer, the attacker triggers buffer replacement; the kernel frees the original vmalloc pages. The attacker can then access the freed memory through the still-valid userspace mapping, reading or writing freed kernel pages [1].

Impact

Successful exploitation allows an attacker with local access to read or write freed kernel memory, leading to information disclosure (leaking sensitive kernel data) or memory corruption. The attacker can potentially escalate privileges by overwriting freed structures or gain arbitrary read/write within kernel space, as the use-after-free occurs in vmalloc memory that may contain critical kernel objects. The scope is local, but the impact includes kernel information disclosure and potential privilege escalation [1].

Mitigation

The fix adds a vm_operations_struct with open/close callbacks that maintain an atomic mmap_count on the dlfb_data structure. In dlfb_realloc_framebuffer(), the code now checks mmap_count and returns -EBUSY if the buffer is currently mapped, preventing buffer replacement while userspace holds stale PTEs. The fix is committed to the Linux stable kernel trees; administrators should update to kernels containing commit 4f312c30f0368e8d2a76aa650dff73f23490b5e7 (or its backport, commit da9b065cedfd3b574f229d5be594e6aa47a27ae6) [1][2]. No workaround is available without applying the patch; users should avoid concurrent device disconnection while applications hold open mmaps on udlfb devices, or ensure the latest patched kernel is installed. The CVE is not currently listed in CISA's Known Exploited Vulnerabilities catalog.