PT-2026-64360 · Linux · Linux

CVE-2026-64245

Publicado

2026-07-24

Atualizado

2026-07-24

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.

In the Linux kernel, the following vulnerability has been resolved:

fbdev: modedb: fix a possible UAF in fb find mode()

If mode option is NULL, it is assigned from mode option buf:

if (!mode option) { fb get options(NULL, &mode option buf); mode option = mode option buf; }

Later, name is assigned from mode option:

const char *name = mode option;

However, mode option buf is freed before name is no longer used:

kfree(mode option buf);

while name is still accessed by:

if ((name matches(db[i], name, namelen) ||

Since name aliases mode option buf, this may result in a use-after-free.

Fix this by extending the lifetime of mode option buf until the end of the function by using scope-based resource management for cleanup.

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

CVE-2026-64245

Linux