Skip to main content

Linux Kernel CVE-2025-40323

| EUVDEUVD-2025-201622 HIGH
2025-12-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local ioctl-triggered kernel use-after-free by a low-privileged user with framebuffer access; kernel memory corruption yields high confidentiality, integrity, and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.8 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201622
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
CVE Published
Dec 08, 2025 - 01:16 cve.org
HIGH 7.8
CVE Published
Dec 08, 2025 - 01:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fbcon: Set fb_display[i]->mode to NULL when the mode is released

Recently, we discovered the following issue through syzkaller:

BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0 Read of size 4 at addr ff11000001b3c69c by task syz.xxx ... Call Trace: <TASK> dump_stack_lvl+0xab/0xe0 print_address_description.constprop.0+0x2c/0x390 print_report+0xb9/0x280 kasan_report+0xb8/0xf0 fb_mode_is_equal+0x285/0x2f0 fbcon_mode_deleted+0x129/0x180 fb_set_var+0xe7f/0x11d0 do_fb_ioctl+0x6a0/0x750 fb_ioctl+0xe0/0x140 __x64_sys_ioctl+0x193/0x210 do_syscall_64+0x5f/0x9c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Based on experimentation and analysis, during framebuffer unregistration, only the memory of fb_info->modelist is freed, without setting the corresponding fb_display[i]->mode to NULL for the freed modes. This leads to UAF issues during subsequent accesses. Here's an example of reproduction steps:

  1. With /dev/fb0 already registered in the system, load a kernel module

to register a new device /dev/fb1;

  1. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);
  2. Switch console from fb to VGA (to allow normal rmmod of the ko);
  3. Unload the kernel module, at this point fb1's modelist is freed, leaving

a wild pointer in fb_display[];

  1. Trigger the bug via system calls through fb0 attempting to delete a mode

from fb0.

Add a check in do_unregister_framebuffer(): if the mode to be freed exists in fb_display[], set the corresponding mode pointer to NULL.

AnalysisAI

Local privilege escalation and kernel memory corruption in the Linux kernel's framebuffer console (fbcon) subsystem arises from a use-after-free: when a framebuffer device is unregistered, the freed mode list leaves dangling pointers in the global fb_display[] array, which fb_mode_is_equal() later dereferences. A local low-privileged attacker with access to framebuffer devices (/dev/fbN) can trigger the freed-memory read/write via FBIOPUT_CON2FBMAP and mode-deletion ioctls, enabling denial of service or potential arbitrary kernel code execution. The flaw was found via syzkaller (KASAN slab-use-after-free), it carries EPSS 0.04% (11th percentile), it is not in CISA KEV, and no public exploit is identified - though detailed reproduction steps are published in the commit message.

Technical ContextAI

The bug lives in the fbcon (framebuffer console) layer of the Linux kernel graphics stack, which maps registered framebuffer devices to virtual consoles. Each console's display state is held in the global fb_display[] array, whose ->mode field can point into a specific fb_info->modelist. During do_unregister_framebuffer(), the kernel freed fb_info->modelist without clearing any fb_display[i]->mode entries that still referenced those now-freed fb_videomode structures. A subsequent fbcon_mode_deleted() → fb_mode_is_equal() call then reads the freed structure. The root cause is a classic use-after-free (CWE-416) driven by a dangling pointer that outlives its object; CWE is reported as N/A in the feed but the KASAN trace ('slab-use-after-free in fb_mode_is_equal') confirms the class. The fix adds a check in do_unregister_framebuffer() to set the matching fb_display[] mode pointer to NULL when the mode is released.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux kernel - 6.1.159, 6.6.117, 6.12.58, 6.17.8, or 6.18 or later, whichever matches your branch - which adds the NULL-out of fb_display[] mode pointers in do_unregister_framebuffer(). Distribution users should apply their vendor kernel update; Ubuntu users specifically should install the kernel from USN-8095-1 (https://ubuntu.com/security/notices/USN-8095-1) and reboot. Where immediate patching is not possible, reduce exposure by restricting access to framebuffer devices (tighten permissions/ownership on /dev/fb* so untrusted local users cannot issue framebuffer ioctls) and by preventing untrusted users from loading kernel modules (e.g. set modules_disabled or use module signing), since the published reproduction path depends on registering a second framebuffer via a loadable module; the trade-off is that locking down /dev/fb* or module loading can break legitimate console-graphics, KMS fallback, or driver-loading workflows. On headless servers, disabling the framebuffer console entirely removes the affected code path.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40323 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy