CVE-2026-53401

In the Linux kernel, the following vulnerability has been resolved:

fbdev: omap2: fix use-after-free in omapfb_mmap

omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that

can lead to use-after-free:

The fb_mmap() entry point holds mm_lock but not lock (fb_info->lock),

while ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock.

This allows concurrent execution.

In omapfb_mmap():

1. rg = omapfb_get_mem_region(ofbi->region); // Get old region ref

2. start = omapfb_get_region_paddr(ofbi); // Read from NEW region

3. len = fix->smem_len; // Read from NEW region

4. vm_iomap_memory(vma, start, len); // Map NEW region memory

5. atomic_inc(&rg->map_count); // Increment OLD region!

Concurrently, OMAPFB_SETUP_PLANE can:

- Reassign ofbi->region = new_rg

- Update fix->smem_len

- OMAPFB_SETUP_MEM then checks NEW region's map_count (0!) and frees it

This leaves userspace with a mapping to freed physical memory.

The fix is to read all required values (start, len) from the same

region reference (rg) that will have its map_count incremented,

preventing the region from being freed while still mapped.