« Volver al listado

CVE-2026-53401

Estado: AnalizadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

fbdev: omap2: fix use-after-free in omapfb_mmap

omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that can lead to use-after-free:

The fb_mmap() entry point holds mm_lock but not lock (fb_info->lock), while ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock. This allows concurrent execution.

In omapfb_mmap(): 1. rg = omapfb_get_mem_region(ofbi->region); // Get old region ref 2. start = omapfb_get_region_paddr(ofbi); // Read from NEW region 3. len = fix->smem_len; // Read from NEW region 4. vm_iomap_memory(vma, start, len); // Map NEW region memory 5. atomic_inc(&rg->map_count); // Increment OLD region!

Leer descripción completaMostrar menos

Concurrently, OMAPFB_SETUP_PLANE can: - Reassign ofbi->region = new_rg - Update fix->smem_len - OMAPFB_SETUP_MEM then checks NEW region's map_count (0!) and frees it

This leaves userspace with a mapping to freed physical memory.

The fix is to read all required values (start, len) from the same region reference (rg) that will have its map_count incremented, preventing the region from being freed while still mapped.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad local (AV:L/PR:L) que permite escalada mediante race condition en ioctl. Use-after-free accesible por usuario privilegiado puede ejecutar código o leer memoria.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationBehavior Prevention on Endpoint

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-53401",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "078ff546a806b2c2ab74c25c8edd4c6d4680656a",
              "lessThan": "6eb6ebcc8590007ad59ddccc8b5f9201655b33f8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "078ff546a806b2c2ab74c25c8edd4c6d4680656a",
              "lessThan": "7958e67375aa111522086286bba13cfc0816ce8d",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/video/fbdev/omap2/omapfb/omapfb-main.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.36",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/video/fbdev/omap2/omapfb/omapfb-main.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-19T12:16:51.287",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/6eb6ebcc8590007ad59ddccc8b5f9201655b33f8",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7958e67375aa111522086286bba13cfc0816ce8d",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: omap2: fix use-after-free in omapfb_mmap\n\nomapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that\ncan lead to use-after-free:\n\nThe fb_mmap() entry point holds mm_lock but not lock (fb_info->lock),\nwhile ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock.\nThis allows concurrent execution.\n\nIn omapfb_mmap():\n1. rg = omapfb_get_mem_region(ofbi->region);      // Get old region ref\n2. start = omapfb_get_region_paddr(ofbi);          // Read from NEW region\n3. len = fix->smem_len;                             // Read from NEW region\n4. vm_iomap_memory(vma, start, len);               // Map NEW region memory\n5. atomic_inc(&rg->map_count);                      // Increment OLD region!\n\nConcurrently, OMAPFB_SETUP_PLANE can:\n- Reassign ofbi->region = new_rg\n- Update fix->smem_len\n- OMAPFB_SETUP_MEM then checks NEW region's map_count (0!) and frees it\n\nThis leaves userspace with a mapping to freed physical memory.\n\nThe fix is to read all required values (start, len) from the same\nregion reference (rg) that will have its map_count incremented,\npreventing the region from being freed while still mapped."
    }
  ],
  "lastModified": "2026-08-17T05:17:14.957",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E72580C0-1F28-4AAD-A1A1-E44AE63D4213",
              "versionEndExcluding": "7.1.3",
              "versionStartIncluding": "2.6.36"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}