---
id: CVE-2026-53401
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fbdev: omap2: fix use-after-free in omapfb_mmap

  omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that
  can lead to use-after-free:

  The fb_mmap() entry …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fbdev: omap2: fix use-after-free in omapfb_mmap

  omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that
  can lead to use-after-free:

  The fb_mmap() entry …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.36, < 7.1.3'
patched:
  - linux_kernel 7.1.3
published: '2026-07-19'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:37.370'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53401'
references:
  - url: 'https://git.kernel.org/stable/c/6eb6ebcc8590007ad59ddccc8b5f9201655b33f8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7958e67375aa111522086286bba13cfc0816ce8d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8363c219d88e78daaee5665117a0380442989338'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5e10b1747547c3815e90d28166e92144835e065f'
  - url: 'https://git.kernel.org/stable/c/986d5fafb73b8b866651399934b66d690f49135a'
tags:
  - nvd
  - cve.org
epss: 0.00139
epssPercentile: 0.03285
ingestedAt: '2026-07-19T23:34:10.536Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fbdev: omap2: fix use-after-free in omapfb_mmap

omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that
can lead to use-after-free:

The fb_mmap() entry point holds mm_lock but not lock (fb_info->lock),
while ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock.
This allows concurrent execution.

In omapfb_mmap():
1. rg = omapfb_get_mem_region(ofbi->region);      // Get old region ref
2. start = omapfb_get_region_paddr(ofbi);          // Read from NEW region
3. len = fix->smem_len;                             // Read from NEW region
4. vm_iomap_memory(vma, start, len);               // Map NEW region memory
5. atomic_inc(&rg->map_count);                      // Increment OLD region!

Concurrently, OMAPFB_SETUP_PLANE can:
- Reassign ofbi->region = new_rg
- Update fix->smem_len
- OMAPFB_SETUP_MEM then checks NEW region's map_count (0!) and frees it

This leaves userspace with a mapping to freed physical memory.

The fix is to read all required values (start, len) from the same
region reference (rg) that will have its map_count incremented,
preventing the region from being freed while still mapped.

## Affected

- `linux_kernel >= 2.6.36, < 7.1.3`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.1.3`