PT-2026-61142 · Linux · Linux Kernel

CVE-2026-63826 · Published 2026-07-19 · Updated 2026-07-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the store modes() function within the fbdev component. The function replaces a framebuffer modelist with modes from userspace and frees the old list using fb destroy modelist(), but fails to clear pointers that still reference the freed memory. Specifically, the fb display[i].mode pointer may remain stale if a console is unmapped, leading to a use-after-free when fbcon mode deleted() reads it via fb mode is equal(). Additionally, the fb info->mode pointer is not updated, causing a use-after-free when show mode() dereferences it through mode string().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63826

Affected Products

Linux Kernel

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-63826 · Security Note
• https://twitter.com/windowsforum/status/2079104314832818194 · Twitter Post
• https://git.kernel.org/stable/c/5267eab88fa4c684459504b8be577ad64953b9a6 · Note
• https://git.kernel.org/stable/c/70f1e000b88cfa8ca3fd7f4d082647fc089a7769 · Note
• https://twitter.com/VulmonFeeds/status/2078858734390903188 · Twitter Post
• https://git.kernel.org/stable/c/c6765f39ed27014ff877b00a2efa494233404e17 · Note
• https://git.kernel.org/stable/c/2c1c805c65fb7dc7524e20376d6987721e73a0b1 · Note
• https://git.kernel.org/stable/c/0d35f9f194a858567a21017d69318a51e3a822b9 · Note