CVE-2026-43497: fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
fbdev: udlfb: add vmops to dlfbopsmmap to prevent use-after-free
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Configuration
Update udlfb so dlfb_ops_mmap() assigns a vm_operations_struct to the VMA (including open/close callbacks that track active mmaps). This prevents use-after-free by ensuring buffer replacement is blocked while userspace holds stale PTEs referencing the old vmalloc-backed framebuffer pages.
fbdev: udlfb dlfb_ops_mmap() / VMA vm_ops = Add vm_operations_struct with open/close callbacks (track active mmaps) and set vm_ops on the VMA - Configuration
In dlfb_realloc_framebuffer(), maintain/check an mmap_count of active mmaps and, if the buffer is currently mapped (mmap_count indicates active mappings), return -EBUSY to prevent replacing the backing framebuffer while userspace may still reference stale PTEs.
fbdev: udlfb (dlfb_realloc_framebuffer) mmap_count handling = Check mmap_count and return -EBUSY if the buffer is currently mapped
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43497?
The severity of CVE-2026-43497 is rated as 50.
How do I fix CVE-2026-43497?
To fix CVE-2026-43497, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What component is affected by CVE-2026-43497?
CVE-2026-43497 affects the udlfb framebuffer driver in the Linux kernel.
What type of vulnerability is CVE-2026-43497?
CVE-2026-43497 is classified as a Use After Free vulnerability.
When was CVE-2026-43497 published?
CVE-2026-43497 was published on May 21, 2026.