CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
fbdev: defio: Disconnect deferred I/O from the lifetime of struct fbinfo
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using the Linux kernel framebuffer deferred-I/O path are exposed when a userspace process retains an active mapping of graphics memory and the associated framebuffer device is hot-unplugged. Microsoft azl3 kernel 6.6.139.1-1 is also listed as affected.
What does an attacker or local user need to trigger the flaw?
The CVSS vector indicates local access with low privileges and no user interaction is required. The triggering condition described is an active userspace graphics-memory mapping followed by hot-unplug of the framebuffer device.
How does the fix change behavior for existing mappings after device removal?
After the framebuffer information is removed, the fix invalidates the deferred-I/O state associated with remaining mappings. Subsequent accesses to those mappings result in SIGBUS rather than operating on freed or undefined state.