CVE-2026-53401

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: omap2: fix use-after-free in omapfb_mmap

omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that

can lead to use-after-free:

The fb_mmap() entry point holds mm_lock but not lock (fb_info->lock),

while ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock.

This allows concurrent execution.

In omapfb_mmap():

1. rg = omapfb_get_mem_region(ofbi->region); // Get old region ref

2. start = omapfb_get_region_paddr(ofbi); // Read from NEW region

3. len = fix->smem_len; // Read from NEW region

4. vm_iomap_memory(vma, start, len); // Map NEW region memory

5. atomic_inc(&rg->map_count); // Increment OLD region!

Concurrently, OMAPFB_SETUP_PLANE can:

- Reassign ofbi->region = new_rg

- Update fix->smem_len

- OMAPFB_SETUP_MEM then checks NEW region's map_count (0!) and frees it

This leaves userspace with a mapping to free

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References