CVE-2026-64245

A flaw was found in the Linux kernel's framebuffer device (fbdev) subsystem. Specifically, within the fb_find_mode() function, a use-after-free (UAF) vulnerability exists. This occurs because a memory buffer is released while still being referenced, potentially allowing an attacker to access or manipulate freed memory. Such an exploit could lead to system instability, denial of service, or potentially arbitrary code execution.

This vulnerability is rated as Moderate impact because successful exploitation requires local system access to trigger video mode lookups within the framebuffer subsystem, restricting the blast radius primarily to local denial of service. The flaw stems from premature buffer release during video mode resolution, which can result in kernel memory corruption or an unexpected system crash. On standard Red Hat Enterprise Linux enterprise deployments, particularly headless servers, framebuffer device interactions are minimal during standard operations, significantly reducing practical risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.