CVE-2026-53401

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fbdev: omap2: fix use-after-free in omapfb_mmap<br /> <br /> omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that<br /> can lead to use-after-free:<br /> <br /> The fb_mmap() entry point holds mm_lock but not lock (fb_info-&gt;lock),<br /> while ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock.<br /> This allows concurrent execution.<br /> <br /> In omapfb_mmap():<br /> 1. rg = omapfb_get_mem_region(ofbi-&gt;region); // Get old region ref<br /> 2. start = omapfb_get_region_paddr(ofbi); // Read from NEW region<br /> 3. len = fix-&gt;smem_len; // Read from NEW region<br /> 4. vm_iomap_memory(vma, start, len); // Map NEW region memory<br /> 5. atomic_inc(&amp;rg-&gt;map_count); // Increment OLD region!<br /> <br /> Concurrently, OMAPFB_SETUP_PLANE can:<br /> - Reassign ofbi-&gt;region = new_rg<br /> - Update fix-&gt;smem_len<br /> - OMAPFB_SETUP_MEM then checks NEW region&amp;#39;s map_count (0!) and frees it<br /> <br /> This leaves userspace with a mapping to freed physical memory.<br /> <br /> The fix is to read all required values (start, len) from the same<br /> region reference (rg) that will have its map_count incremented,<br /> preventing the region from being freed while still mapped.