CVE-2026-43497— udlfb 漏洞：添加 vm_ops 防止使用后即释放
可能的 ATT&CK 技术 1AI
T1055.008 · Ptrace System Calls影响版本矩阵 10
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 4f312c30f0368e8d2a76aa650dff73f23490b5e7 | affected |
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 18dd358de72d57993422cbb5dfb29ccd74efe192 | affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< da9b065cedfd3b574f229d5be594e6aa47a27ae6 | affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< a2c53a3822ee26e8d758071815b9ed3bf6669fc1 | affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 8de779dc40d35d39fa07387b6f921eb11df0f511 | affected | ||
6.6.140≤ 6.6.* | unaffected | ||
6.12.88≤ 6.12.* | unaffected | ||
6.18.30≤ 6.18.* | unaffected | ||
| … +2 条更多 | |||
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2026-43497 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages to userspace but sets no vm_ops on the VMA. This means the kernel cannot track active mmaps. When dlfb_realloc_framebuffer() replaces the backing buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated. On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages while userspace PTEs still reference them, resulting in a use-after-free: the process retains read/write access to freed kernel pages. Add vm_operations_struct with open/close callbacks that maintain an atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(), check mmap_count and return -EBUSY if the buffer is currently mapped, preventing buffer replacement while userspace holds stale PTEs. Tested with PoC using dummy_hcd + raw_gadget USB device emulation.
来源: 美国国家漏洞数据库 NVD
CVSS Information
N/A
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
N/A
来源: 美国国家漏洞数据库 NVD
受影响产品
二、漏洞 CVE-2026-43497 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-43497 的情报信息
请登录查看更多情报信息。
同批安全公告 · Linux · 2026-05-21 · 共 8 条
| CVE-2026-43502 | Linux net/rds 零拷贝发送清理顺序漏洞 | |
| CVE-2026-43501 | IPv6 RPL SRH压缩增长时mac_len头空间预留漏洞 | |
| CVE-2026-43498 | Linux内核accel/ivpu模块对象重导出漏洞 | |
| CVE-2026-43499 | Linux 内核 rtmutex 远程代码执行漏洞 | |
| CVE-2026-43496 | Linux 内核 sch_red 远程代码执行漏洞 | |
| CVE-2026-43495 | T7xx WWAN 驱动端口计数验证缺失漏洞 | |
| CVE-2026-43494 | net/rds 零复制页面固定失败时未重置op_nents漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-43497
暂无评论