EUVD-2026-76509
GHSA-4qm2-vqpp-wwm8
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires both uvesafb presence and a forced platform_driver_register() failure-a non-default, difficult-to-trigger condition-making AC:H more accurate than AC:L.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
fbdev: uvesafb: unregister connector callback on init failure
uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_driver_register() fails, the function returns the error directly and leaves the connector callback registered.
The later platform-device failure path already unregisters the callback. Add the same cleanup before the final return when platform-driver registration fails.
This issue was identified during our ongoing static-analysis research while reviewing kernel code.
AnalysisAI
Incomplete error-path cleanup in the Linux kernel uvesafb framebuffer driver leaves a stale v86d connector callback registered when platform driver initialization fails, creating a potential use-after-free condition in kernel memory. All Linux kernel versions from 2.6.24 onward that include the uvesafb driver are affected; the issue was found through static analysis and is patched in 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the uvesafb kernel module to be present and loadable on the target system-a non-default condition on most modern Linux distributions that rely on KMS/DRM framebuffer drivers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates practical risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade to Linux kernel 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify Linux systems with uvesafb framebuffer driver enabled by examining kernel configurations or boot parameters. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today