What is the CVSS score of EUVD-2026-48654?

EUVD-2026-48654 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-48654?

A privilege escalation vulnerability in Linux kernel fbdev subsystem affects multiple actively maintained kernel branches through a use-after-free memory corruption flaw.. A patch is available.

How to fix or mitigate EUVD-2026-48654?

Within 24 hours: Identify and inventory all systems running affected Linux kernel versions (prior to 6.6.144, 6.12.95, 6.18.38, 7.1.3, or 7.2-rc1); prioritize production servers and systems with multi-user access patterns. Within 7 days: Deploy kernel updates to all affected systems, upgrading to patched versions 6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2-rc1 or later as appropriate for your distribution and kernel branch. Within 30 days: Verify patch deployment through automated scanning and kernel version auditing to confirm coverage across all infrastructure.

Linux Kernel EUVD-2026-48654

| CVE-2026-64245 HIGH

Use After Free (CWE-416)

2026-07-24 Linux

GHSA-5hjc-xc74-xxjg

Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AC upgraded to H because reliable heap UAF exploitation requires precise heap feng shui and timing control not reflected in the official AC:L rating.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 21:54 vuln.today

CVSS changed

Aug 17, 2026 - 19:37 NVD

7.8 (HIGH)

Patch available

Jul 24, 2026 - 17:48 EUVD

CVE Published

Jul 24, 2026 - 15:31 nvd

HIGH 7.8

CVE Published

Jul 24, 2026 - 15:31 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

fbdev: modedb: fix a possible UAF in fb_find_mode()

If mode_option is NULL, it is assigned from mode_option_buf:

if (!mode_option) { fb_get_options(NULL, &mode_option_buf); mode_option = mode_option_buf; }

Later, name is assigned from mode_option:

const char *name = mode_option;

However, mode_option_buf is freed before name is no longer used:

kfree(mode_option_buf);

while name is still accessed by:

if ((name_matches(db[i], name, namelen) ||

Since name aliases mode_option_buf, this may result in a use-after-free.

Fix this by extending the lifetime of mode_option_buf until the end of the function by using scope-based resource management for cleanup.

AnalysisAI

Use-after-free in the Linux kernel fbdev subsystem's fb_find_mode() function allows a local attacker with low privileges to read freed kernel heap memory, potentially achieving information disclosure, memory corruption, or privilege escalation. The flaw exists when mode_option is NULL: a heap-allocated buffer (mode_option_buf) is freed while the local alias name still references it during the name_matches() comparison loop. Patched versions are available across multiple stable branches (6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2-rc1). No public exploit exists and EPSS sits at the 6th percentile, but the CVSS 7.8 High score correctly reflects the maximum-impact potential of kernel-level heap memory corruption.

Technical ContextAI

The vulnerable code resides in drivers/video/fbdev/modedb.c within the Linux kernel framebuffer device (fbdev) subsystem, which provides a hardware-independent API for console and basic display output. In fb_find_mode(), when mode_option is NULL, fb_get_options() heap-allocates mode_option_buf and mode_option is assigned to point at it. The local variable name then aliases mode_option (and thus mode_option_buf). The bug is that kfree(mode_option_buf) is called before the name_matches() loop finishes iterating - meaning name dereferences freed heap memory on subsequent loop iterations. This is CWE-416 (Use After Free): a classic heap-lifetime management error. The fix, as described in the patch, extends mode_option_buf's lifetime to function scope using scope-based resource management (cleanup attributes), ensuring the buffer is not freed until fb_find_mode() returns. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched Linux kernel version: 6.6.144, 6.12.95, 6.18.38, 7.1.3, or 7.2-rc1 or later. Distribution maintainers (Red Hat, Ubuntu, Debian, SUSE, etc.) will ship these fixes through standard kernel update channels; apply vendor kernel updates as they become available. Fix commits for each stable branch are at https://git.kernel.org/stable/c/c7dc382439f7b019e207055b52e9cec051d42fa9 and related commits. For systems where immediate kernel upgrade is not feasible, the attack surface can be narrowed by restricting unprivileged user access to framebuffer devices via udev rules (e.g., MODE='0600' on /dev/fb* nodes) or by blacklisting/removing fbdev kernel modules (modprobe -r fbdev, then adding it to /etc/modprobe.d/blacklist.conf) - note that removing fbdev modules will disable console framebuffer graphics and may affect VNC/KVM consoles that depend on the virtual framebuffer. Systems already running without fbdev (typical cloud VMs, container hosts with no framebuffer hardware) are not exposed through this code path and require no additional action beyond the regular kernel update cycle.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected

EUVD-2026-48654 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-48654

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-416 – Use After Free

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code