{"id":"CVE-2026-53401","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: omap2: fix use-after-free in omapfb_mmap\n\nomapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that\ncan lead to use-after-free:\n\nThe fb_mmap() entry …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: omap2: fix use-after-free in omapfb_mmap\n\nomapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that\ncan lead to use-after-free:\n\nThe fb_mmap() entry …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.36, < 7.1.3"],"patched":["linux_kernel 7.1.3"],"published":"2026-07-19","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:17:37.370","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53401","references":[{"url":"https://git.kernel.org/stable/c/6eb6ebcc8590007ad59ddccc8b5f9201655b33f8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7958e67375aa111522086286bba13cfc0816ce8d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8363c219d88e78daaee5665117a0380442989338","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5e10b1747547c3815e90d28166e92144835e065f"},{"url":"https://git.kernel.org/stable/c/986d5fafb73b8b866651399934b66d690f49135a"}],"tags":["nvd","cve.org"],"epss":0.00139,"epssPercentile":0.03285,"ingestedAt":"2026-07-19T23:34:10.536Z","slug":"CVE-2026-53401","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: omap2: fix use-after-free in omapfb_mmap\n\nomapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that\ncan lead to use-after-free:\n\nThe fb_mmap() entry point holds mm_lock but not lock (fb_info->lock),\nwhile ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock.\nThis allows concurrent execution.\n\nIn omapfb_mmap():\n1. rg = omapfb_get_mem_region(ofbi->region);      // Get old region ref\n2. start = omapfb_get_region_paddr(ofbi);          // Read from NEW region\n3. len = fix->smem_len;                             // Read from NEW region\n4. vm_iomap_memory(vma, start, len);               // Map NEW region memory\n5. atomic_inc(&rg->map_count);                      // Increment OLD region!\n\nConcurrently, OMAPFB_SETUP_PLANE can:\n- Reassign ofbi->region = new_rg\n- Update fix->smem_len\n- OMAPFB_SETUP_MEM then checks NEW region's map_count (0!) and frees it\n\nThis leaves userspace with a mapping to freed physical memory.\n\nThe fix is to read all required values (start, len) from the same\nregion reference (rg) that will have its map_count incremented,\npreventing the region from being freed while still mapped.\n\n## Affected\n\n- `linux_kernel >= 2.6.36, < 7.1.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.1.3`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":222171,"id":"CVE-2026-53401","ts":1792062190684,"field":"cvss","old":null,"new":"7.8"},{"seq":222170,"id":"CVE-2026-53401","ts":1792062190684,"field":"severity","old":"none","new":"high"}]}