CVE-2026-46065

A flaw was found in the Linux kernel's framebuffer device (fbdev) deferred I/O (defio) mechanism. A local user with an active mapping of graphics memory could trigger a device hot-unplug, leading to the system accessing undefined memory. This can result in system instability or a crash, causing a Denial of Service (DoS).

fbdev deferred I/O used a mapping-private pointer to fb_info while user space could keep an active mmap after device hot-unplug. If fb_info was freed before the last VMA was closed, later fault or page_mkwrite handling could operate on stale kernel state and trigger a use-after-free. For the CVSS the PR:L is selected because practical triggering requires local access to the framebuffer device and an active mmap, but this does not necessarily require full host root in systems where /dev/fb access is delegated to a local user or graphics group. The issue is not network reachable and normally depends on a hot-unplug or device removal event, so AC:H is appropriate. Impact is at least local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.