CVE-2026-63826: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63826 Overview

CVE-2026-63826 is a use-after-free vulnerability in the Linux kernel framebuffer device (fbdev) subsystem. The flaw resides in the store_modes() function, which replaces a framebuffer's modelist with modes supplied from userspace. After freeing the previous modelist with fb_destroy_modelist(), two pointers continue to reference the freed memory: fb_display[i].mode for unmapped consoles and fb_info->mode for the current mode exposed through sysfs.

Subsequent access through the FBIOPUT_VSCREENINFO ioctl or reads of the mode sysfs attribute dereference the stale pointers, producing use-after-free reads in kernel memory.

Critical Impact
Local users interacting with framebuffer devices can trigger kernel-mode use-after-free reads, enabling information disclosure or memory corruption on affected Linux systems.

Affected Products

Linux kernel fbdev framebuffer subsystem
Systems using fbcon (framebuffer console) with dynamic mode configuration
Distributions shipping affected kernel branches prior to the referenced stable commits

Discovery Timeline

2026-07-19 - CVE-2026-63826 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63826

Vulnerability Analysis

The vulnerability [CWE-416] exists in the store_modes() function of the Linux kernel framebuffer subsystem. When userspace writes a new modelist to the framebuffer's modes sysfs attribute, store_modes() replaces the existing modelist and calls fb_destroy_modelist() on the old entries.

Two kernel pointers still reference the freed list after this operation. The first is fb_display[i].mode, which tracks the mode a console uses. The helper fbcon_new_modelist() migrates these pointers to the new list, but only for consoles still mapped to the framebuffer. Unmapped consoles, such as those left behind when fbcon is unbound and con2fb_map[i] is set to -1, retain their stale pointers. A later FBIOPUT_VSCREENINFO ioctl with the FB_ACTIVATE_INV_MODE flag calls fbcon_mode_deleted(), which reads fb_display[i].mode via fb_mode_is_equal(), producing the first use-after-free read.

The second pointer is fb_info->mode, which represents the current mode. store_modes() does not update this field, so it continues to point into freed memory. When userspace reads the mode sysfs attribute, show_mode() calls mode_string() on fb_info->mode, producing the second use-after-free read.

Root Cause

The root cause is incomplete cleanup during modelist replacement. store_modes() frees the old modelist without clearing every kernel pointer that references entries in it. Unmapped consoles and the framebuffer's current-mode pointer are not scrubbed before fb_destroy_modelist() runs.

Attack Vector

An attacker with local access and permission to interact with the framebuffer sysfs attributes and ioctls can trigger the flaw. Writing to the modes sysfs attribute frees the modelist, and subsequent reads of the mode attribute or an FBIOPUT_VSCREENINFO ioctl carrying FB_ACTIVATE_INV_MODE dereferences the dangling pointer.

No verified public exploit is available. The vulnerability mechanism is described in the upstream commit messages; refer to the Linux Kernel Commit 2c1c805c and related stable backports for technical details.

Detection Methods for CVE-2026-63826

Indicators of Compromise

Kernel oops or KASAN reports referencing fb_mode_is_equal, fbcon_mode_deleted, mode_string, or show_mode call sites
Unexpected process interaction with /sys/class/graphics/fb*/mode and /sys/class/graphics/fb*/modes attributes from non-administrative accounts
Unusual sequences of FBIOPUT_VSCREENINFO ioctls on /dev/fb* devices following fbcon unbind operations

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and staging kernels to surface use-after-free reads in the fbdev subsystem
Audit kernel version strings against the fixed commits 0d35f9f1, 2c1c805c, 5267eab8, 70f1e000, and c6765f39
Correlate audit logs for writes to framebuffer sysfs attributes with subsequent framebuffer ioctl activity

Monitoring Recommendations

Forward kernel logs and dmesg output to a centralized logging platform and alert on framebuffer-related oops or KASAN traces
Track unbind operations against fbcon followed by framebuffer ioctl usage from the same process context
Monitor loaded kernel versions across the fleet to confirm patch adoption

How to Mitigate CVE-2026-63826

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits and rebuild or upgrade affected kernels
Restrict access to /dev/fb* devices and /sys/class/graphics/fb*/ attributes to trusted administrative users only
Where framebuffer console functionality is not required, disable CONFIG_FB or blacklist unused framebuffer drivers

Patch Information

The fix clears both dangling pointers before freeing the modelist. store_modes() now calls fbcon_delete_modelist(), introduced by commit a1f305893074 ("fbcon: Set fb_display[i]->mode to NULL when the mode is released"), to null every fb_display[i].mode that references the old list, and sets fb_info->mode to NULL. Backports are available in the following stable commits:

Workarounds

Restrict permissions on framebuffer sysfs mode attributes so only privileged accounts can modify them
Avoid unbinding fbcon on systems that still expose framebuffer mode configuration to non-root processes
Disable unused framebuffer drivers via kernel module blacklisting where the framebuffer console is not needed

bash

# Restrict framebuffer sysfs and device access to root
chmod 600 /sys/class/graphics/fb0/mode /sys/class/graphics/fb0/modes
chmod 600 /dev/fb0

# Optionally blacklist unused framebuffer drivers
echo "blacklist vesafb" | sudo tee /etc/modprobe.d/blacklist-fbdev.conf