EUVD-2026-76497
GHSA-72rp-5pw2-wrgc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H reflects dual gates of non-default CONFIG_CHARLCD_BL_FLASH and the error-path-only trigger; local low-priv access otherwise matches PR:L/AV:L.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
auxdisplay: charlcd: cancel backlight work on registration failure
With CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before charlcd_register() calls misc_register(). If registration fails, the caller frees the charlcd object while delayed work still contains its address.
Add charlcd_deinit() to cancel the delayed work and turn the backlight off. Use it for both registration rollback and normal unregistration.
AnalysisAI
Use-after-free in the Linux kernel's auxdisplay charlcd driver allows a local, low-privileged attacker to potentially corrupt kernel memory when charlcd_register() fails after bl_work has already been scheduled. The root cause is that charlcd_init() schedules a delayed backlight work item referencing the charlcd object before misc_register() is called; if registration fails, the caller frees the object while the work item's reference remains valid, creating a classic UAF condition. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | CONFIG_CHARLCD_BL_FLASH must be enabled at kernel build time (non-default). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) captures the theoretical kernel-UAF impact but overstates attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to Linux kernel 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1, which include the charlcd_deinit() fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify systems running the auxdisplay charlcd driver by scanning kernel configurations across the infrastructure; within 7 days, apply the available vendor patch to all affected systems; within 30 days, complete validation and full deployment across any remaining affected endpoints.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today