CVE-2025-40323

A use-after-free vulnerability was identified in the Linux kernel framebuffer console (fbcon) subsystem. During framebuffer unregistration, the kernel freed the memory for a display mode but did not clear the corresponding fb_display[i]->mode pointer. Subsequent framebuffer ioctl operations could then dereference the stale pointer, resulting in a kernel oops or crash.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires local access and complex prerequisites to manipulate framebuffer device registrations, which are typically restricted to administrative users. In default deployments, ordinary users cannot register or unregister console devices or load arbitrary kernel drivers, significantly limiting the attack surface. While a successful exploit could lead to a denial of service through a system crash or potential memory corruption, the necessity of privileged local interaction prevents widespread or remote exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria, comprising ease of use and deployment, applicability to widespread installation base or stability.