What is the CVSS score of EUVD-2026-45456?

EUVD-2026-45456 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-45456?

Within 24 hours: Identify and inventory all systems running Linux on TI OMAP2 devices, documenting their current kernel versions to assess exposure to CVE-2026-53401. Within 7 days: Apply the patched Linux kernel version specified in the vendor advisory to all affected TI OMAP2 systems, beginning with production environments. Within 30 days: Verify kernel updates are deployed across all TI OMAP2 devices through automated scanning and implement local system access restrictions to reduce attack surface on any unpatched systems.

Linux Kernel EUVD-2026-45456

| CVE-2026-53401 HIGH

Use After Free (CWE-416)

2026-07-19 Linux

GHSA-jrv4-9p26-4849

Information Disclosure Linux Use After Free Memory Corruption

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain local access to OMAP2 fb device
Delivery

Call mmap on /dev/fb0
Exploit

Race OMAPFB_SETUP_PLANE to swap region
Execution

OMAPFB_SETUP_MEM frees mapped region
Persist

Retain mapping to freed physical memory
Impact

Read or reallocate freed kernel memory

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires local access to an OMAP2/omapfb framebuffer device node (typically /dev/fb0) on Texas Instruments OMAP2-based hardware, and the ability to invoke both fb_mmap() and the OMAPFB_SETUP_PLANE/OMAPFB_SETUP_MEM ioctls - access that generally implies root or video-group membership (PR:L). The attacker must concurrently drive mmap and the plane/mem reconfiguration ioctls to win the use-after-free race. Limiting factors: the vulnerable code exists only in the omap2 fbdev driver, so non-OMAP2 systems are unaffected; exploitation is not remote (AV:L) and requires no user interaction from a victim, but does require reliably winning a timing-sensitive race, which materially raises real-world difficulty.
Impact	The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H, 7.8) reflects a high-impact local kernel bug, but the AC:L rating understates reality: exploitation hinges on winning a narrow race between mmap and an ioctl, which in practice is closer to AC:H, so I assess ~7.0. No EPSS score, KEV listing, or POC was provided - consistent with a freshly disclosed stable-tree kernel fix rather than an exploited-in-the-wild flaw. There is no SSVC decision data. The strongest limiting factor is that the vulnerable code path only exists on OMAP2 hardware and requires local access to the framebuffer device, which typically means root or membership in the video group. This is a legitimate defense-in-depth patch for affected embedded fleets but not a broadly urgent internet-facing threat; treat it as routine kernel-hygiene patching unless you run OMAP2-based devices with untrusted local users.
Exploit ScenarioDerived	A local user with access to the OMAP2 framebuffer device opens /dev/fb0 and, in one thread, repeatedly calls mmap() while a second thread rapidly issues OMAPFB_SETUP_PLANE followed by OMAPFB_SETUP_MEM to reassign and free the underlying region. On a winning race the process retains a page-table mapping to freed physical memory, which can be read or reallocated to leak kernel data or corrupt adjacent allocations. No public exploit is identified at time of analysis, and success requires reliably hitting the timing window.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Local privilege escalation and kernel memory corruption in the Linux kernel's omap2 framebuffer driver (omapfb) arises from a use-after-free race between omapfb_mmap() and the OMAPFB_SETUP_PLANE/OMAPFB_SETUP_MEM ioctls. Because fb_mmap() holds only mm_lock while the ioctl path holds only fb_info->lock, a local user on a TI OMAP2 device can reassign a framebuffer region mid-mmap so that the map_count of the freed region is never incremented, leaving userspace with a mapping to freed physical memory. This is an information-disclosure/corruption primitive (tagged 'Information Disclosure') with no public exploit identified at time of analysis; the upstream fix is merged and a patched release exists.

RemediationAI

Vendor-released patch: upgrade to Linux 7.1.3 or 7.2-rc1 (or later), which changes omapfb_mmap() to read start and len from the same region reference it increments, closing the race; the fix is in stable commits 6eb6ebcc8590007ad59ddccc8b5f9201655b33f8 and 7958e67375aa111522086286bba13cfc0816ce8d. If immediate patching is not possible on OMAP2 devices, restrict access to /dev/fb* by tightening ownership/permissions and removing untrusted users from the video group, which prevents the local ioctl/mmap sequence at the cost of breaking legitimate direct framebuffer consumers; where the OMAP2 framebuffer is unused, blacklisting or not building the omapfb module eliminates the code path entirely but disables that display driver. Track distribution stable-kernel backports and apply them as they ship.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6eb6ebcc8590007ad59ddccc8b5f9201655b33f8

Linux 0 <7.1.3

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <7958e67375aa111522086286bba13cfc0816ce8d

Linux patch: 7.1.3

Linux patch: 7.2-rc1

Affected Packages

euvd linux fix: 7.1.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is fbdev's OMAP2 framebuffer driver (drivers/video/fbdev/omap2), used on Texas Instruments OMAP2/3 SoCs found in embedded and mobile ARM hardware. The root-cause class is a use-after-free (CWE-416) driven by inconsistent locking: fb_mmap() serializes on the mm's mmap lock, while ioctl handlers serialize on fb_info->lock, so the two paths can run concurrently. In omapfb_mmap() the code captures a reference to the old memory region (rg = omapfb_get_mem_region), but then reads the physical start address and smem_len from the *current* ofbi->region, which OMAPFB_SETUP_PLANE may have swapped for a new region; the atomic map_count increment is applied to the old region while the mapping actually points at the new region. OMAPFB_SETUP_MEM subsequently sees map_count==0 for the new region and frees still-mapped physical memory. The fix reads start and len from the same rg whose map_count is incremented, keeping the mapped region pinned.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.0 HIGH

Local fb-device access needed (AV:L, PR:L) and success depends on winning a narrow mmap-vs-ioctl race (AC:H); UAF yields full kernel memory read/corrupt impact (C:H/I:H/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 14:17 EUVD

CVE Published

Jul 19, 2026 - 12:02 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 12:02 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fbdev: omap2: fix use-after-free in omapfb_mmap

omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that can lead to use-after-free:

The fb_mmap() entry point holds mm_lock but not lock (fb_info->lock), while ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock. This allows concurrent execution.

In omapfb_mmap():

rg = omapfb_get_mem_region(ofbi->region); // Get old region ref
start = omapfb_get_region_paddr(ofbi); // Read from NEW region
len = fix->smem_len; // Read from NEW region
vm_iomap_memory(vma, start, len); // Map NEW region memory
atomic_inc(&rg->map_count); // Increment OLD region!

Concurrently, OMAPFB_SETUP_PLANE can:

Reassign ofbi->region = new_rg
Update fix->smem_len
OMAPFB_SETUP_MEM then checks NEW region's map_count (0!) and frees it

This leaves userspace with a mapping to freed physical memory.

The fix is to read all required values (start, len) from the same region reference (rg) that will have its map_count incremented, preventing the region from being freed while still mapped.

Executive ViewAI

Why It Matters

A kernel-level vulnerability (CVE-2026-53401) in the Linux omap2 framebuffer driver allows local attackers on TI OMAP2 devices to escalate privileges and disclose or corrupt sensitive kernel memory; no public exploit has been identified to date. Organizations using TI OMAP2 devices in embedded systems, IoT deployments, or legacy platforms face material risk of unauthorized data access and system compromise. A patch is available from the upstream Linux kernel and should be deployed immediately.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Prevalence

Low

niche omap2 embedded display driver, requires TI OMAP2 hardware

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53401 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/380142 REF https://git.kernel.org/stable/c/5e10b1747547c3815e90d28166e92144835e065f REF https://git.kernel.org/stable/c/6eb6ebcc8590007ad59ddccc8b5f9201655b33f8 REF https://git.kernel.org/stable/c/7958e67375aa111522086286bba13cfc0816ce8d REF https://git.kernel.org/stable/c/8363c219d88e78daaee5665117a0380442989338 REF https://git.kernel.org/stable/c/986d5fafb73b8b866651399934b66d690f49135a REF https://git.kernel.org/stable/c/a1a00f664a409b3412f9e1408c12890cffe50362

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back