CVE-2026-63826

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fbdev: fix use-after-free in store_modes()<br /> <br /> store_modes() replaces a framebuffer&amp;#39;s modelist with modes from userspace.<br /> On success it frees the old modelist with fb_destroy_modelist(). Two<br /> fields still point into that freed list.<br /> <br /> One pointer is fb_display[i].mode, the mode a console is using.<br /> fbcon_new_modelist() moves these pointers to the new list. It only does so<br /> for consoles still mapped to the framebuffer. An unmapped console is<br /> skipped and keeps its stale pointer. Unbinding fbcon, for example, sets<br /> con2fb_map[i] to -1 but leaves fb_display[i].mode set. An<br /> FBIOPUT_VSCREENINFO ioctl with FB_ACTIVATE_INV_MODE later reaches<br /> fbcon_mode_deleted(). That function reads the stale fb_display[i].mode<br /> through fb_mode_is_equal(). The read is a use-after-free.<br /> <br /> The other pointer is fb_info-&gt;mode, the current mode. It is set through<br /> the mode sysfs attribute. store_modes() does not update fb_info-&gt;mode, so<br /> it is left pointing into the freed list. show_mode(), the attribute&amp;#39;s read<br /> handler, dereferences the stale fb_info-&gt;mode through mode_string(). The<br /> read is a use-after-free.<br /> <br /> Clear both pointers before freeing the list. Commit a1f305893074 ("fbcon:<br /> Set fb_display[i]-&gt;mode to NULL when the mode is released") added the<br /> helper fbcon_delete_modelist(). It clears every fb_display[i].mode that<br /> points into a given list. So far it is called only from the unregister<br /> path. Call it from store_modes() too, and set fb_info-&gt;mode to NULL.