CVE-2026-43497

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free

dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages

to userspace but sets no vm_ops on the VMA. This means the kernel cannot

track active mmaps. When dlfb_realloc_framebuffer() replaces the backing

buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated.

On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages

while userspace PTEs still reference them, resulting in a use-after-free:

the process retains read/write access to freed kernel pages.

Add vm_operations_struct with open/close callbacks that maintain an

atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(),

check mmap_count and return -EBUSY if the buffer is currently mapped,

preventing buffer replacement while userspace holds stale PTEs.

Tested with PoC using dummy_hcd + raw_gadget USB device emulation.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References