CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode()
High 7.8 EPSS 0.1% Linux kernel
In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible UAF in fb_find_mode() If mode_option is NULL, it is assigned from mode_option_buf: if (!mode_option) { fb_get_options(NULL, &mode_option_buf); mode_option = mode_option_buf; } Later, name is assigned from mode_option: const char *name = mode_option; However, mode_option_buf is freed before name is no longer used: kfree(mode_option_buf); while name is still accessed by: if ((name_matches(db[i], name, namelen) || Since name aliases mode_option_buf, this may result in a use-after-free. Fix this by extending the lifetime of mode_option_buf until the end of the function by using scope-based resource management for cleanup.
- CVE-2026-64245CVE identifier
- 7.8CVSS 3.1 base score (high)
- 0.1%EPSS: chance of exploitation in the next 30 days (higher than 2% of CVEs)
- 2026-07-24published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run Linux kernel and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Reboot into the new kernel (uname -r to confirm); live patching (kpatch, Ubuntu Livepatch, SUSE kGraft/klp) can defer the reboot for some CVEs
Affected and fixed versions
Affected:
- Linux Linux 089d924d03d5c17b05d02992f57671ccfba1c4f0 to before c7dc382439f7b019e207055b52e9cec051d42fa9
- Linux Linux 089d924d03d5c17b05d02992f57671ccfba1c4f0 to before f906347d75c7fc377041c6d3c535d0f08846aada
- Linux Linux 089d924d03d5c17b05d02992f57671ccfba1c4f0 to before 4d418cf8daf57e454b4d855bf9b2419fd8e6a540
- Linux Linux 089d924d03d5c17b05d02992f57671ccfba1c4f0 to before 13b6f0cdd5cd5e60f682ec43134ab0e2024bd356
- Linux Linux 089d924d03d5c17b05d02992f57671ccfba1c4f0 to before 85b6256469cebdac395e7447147e06b2e151014f
- Linux Linux 6.4
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade linux-image-amd64Ubuntu
sudo apt update
sudo apt install --only-upgrade linux-image-generic (or the installed flavour: linux-image-aws, -azure, -gcp, -virtual)RHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh kernelFedora
sudo dnf upgrade --refresh kernelSUSE / openSUSE
sudo zypper refresh
sudo zypper update kernel-defaultAmazon Linux
sudo dnf upgrade --releasever=latest kernel kernel6.12Arch Linux
sudo pacman -SyuAlpine
apk update && apk upgrade linux-lts linux-virtFreeBSD
not LinuxGeneral update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | linux | not affected | |
| Debian 13 | linux | fixed | 6.12.95-1 |
| Debian testing | linux | fixed | 7.1.3-1 |
| Red Hat Enterprise Linux 9 | kernel | fix deferred | |
| Red Hat Enterprise Linux 9 | kernel-rt | fix deferred | |
| Red Hat Enterprise Linux 8 | kernel | fix deferred | |
| Red Hat Enterprise Linux 8 | kernel-rt | fix deferred | |
| Red Hat Enterprise Linux 10 | kernel | fix deferred | |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
Sources
- https://git.kernel.org/stable/c/c7dc382439f7b019e207055b52e9cec051d42fa9
- https://git.kernel.org/stable/c/f906347d75c7fc377041c6d3c535d0f08846aada
- https://git.kernel.org/stable/c/4d418cf8daf57e454b4d855bf9b2419fd8e6a540
- https://git.kernel.org/stable/c/13b6f0cdd5cd5e60f682ec43134ab0e2024bd356
- https://git.kernel.org/stable/c/85b6256469cebdac395e7447147e06b2e151014f
- CVE-2026-64245 on CVE.org
- CVE-2026-64245 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.