CVE-2026-23236

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23236", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.988Z", "datePublished": "2026-03-04T14:36:40.162Z", "dateUpdated": "2026-08-05T12:20:48.788Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:20:48.788Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: smscufx: properly copy ioctl memory to kernelspace\n\nThe UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from\nuserspace to kernelspace, and instead directly references the memory,\nwhich can cause problems if invalid data is passed from userspace. Fix\nthis all up by correctly copying the memory before accessing it within\nthe kernel."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered via a local ioctl syscall (UFX_IOCTL_REPORT_DAMAGE) on the /dev/fb* framebuffer device file. The USB device must be physically present but the attack itself is a local system call.\nAC:L - The attacker can reliably trigger the vulnerability with a single ioctl call. No race condition, special timing, or non-default configuration is required.\nPR:L - Opening /dev/fb* typically requires membership in the video group, which is a low-privilege requirement on desktop/workstation systems. No capabilities or root privileges are needed beyond device file access.\nUI:N - No user interaction is required. The attacker independently issues the ioctl to trigger the vulnerability.\nS:U - The vulnerability stays within the kernel's security scope \u2014 there is no escape from a VM, container, or other security boundary.\nC:L - On non-SMAP systems, the kernel reads 16 bytes (struct dloarea: x, y, w, h) from an attacker-controlled kernel address, providing a limited information disclosure primitive through side-channel observation of the subsequent conditional writes and USB transfer behavior.\nI:H - On non-SMAP systems, the kernel conditionally writes constrained values (0 or display resolution integers) to attacker-controlled kernel addresses, providing a write-what-where primitive. Writing 0 to arbitrary kernel addresses is a known exploitation technique for privilege escalation.\nA:H - On SMAP-enabled systems (most modern x86), the direct userspace pointer dereference causes a kernel oops or panic, reliably crashing the system. Even on non-SMAP systems, passing invalid addresses triggers a kernel fault."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/video/fbdev/smscufx.c"], "versions": [{"version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "lessThan": "061cfeb560aa3ddc174153dbe5be9d0b55eb7248", "status": "affected", "versionType": "git"}, {"version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "lessThan": "6167af934f956d3ae1e06d61f45cd0d1004bbe1a", "status": "affected", "versionType": "git"}, {"version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "lessThan": "a0321e6e58facb39fe191caa0e52ed9aab6a48fe", "status": "affected", "versionType": "git"}, {"version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "lessThan": "0634e8d650993602fc5b389ff7ac525f6542e141", "status": "affected", "versionType": "git"}, {"version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "lessThan": "52917e265aa5f848212f60fc50fc504d8ef12866", "status": "affected", "versionType": "git"}, {"version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "lessThan": "1c008ad0f0d1c1523902b9cdb08e404129677bfc", "status": "affected", "versionType": "git"}, {"version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "lessThan": "f1e91bd4efeae48b0f42caed7e8ce2e3a0d05b02", "status": "affected", "versionType": "git"}, {"version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "lessThan": "120adae7b42faa641179270c067864544a50ab69", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/video/fbdev/smscufx.c"], "versions": [{"version": "3.2", "status": "affected"}, {"version": "0", "lessThan": "3.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.251", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.201", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.164", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.127", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.74", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.13", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.3", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.10.251"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.15.201"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.1.164"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.6.127"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.12.74"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.18.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.19.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/061cfeb560aa3ddc174153dbe5be9d0b55eb7248"}, {"url": "https://git.kernel.org/stable/c/6167af934f956d3ae1e06d61f45cd0d1004bbe1a"}, {"url": "https://git.kernel.org/stable/c/a0321e6e58facb39fe191caa0e52ed9aab6a48fe"}, {"url": "https://git.kernel.org/stable/c/0634e8d650993602fc5b389ff7ac525f6542e141"}, {"url": "https://git.kernel.org/stable/c/52917e265aa5f848212f60fc50fc504d8ef12866"}, {"url": "https://git.kernel.org/stable/c/1c008ad0f0d1c1523902b9cdb08e404129677bfc"}, {"url": "https://git.kernel.org/stable/c/f1e91bd4efeae48b0f42caed7e8ce2e3a0d05b02"}, {"url": "https://git.kernel.org/stable/c/120adae7b42faa641179270c067864544a50ab69"}], "title": "fbdev: smscufx: properly copy ioctl memory to kernelspace", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T13:01:07.977Z"}, "affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}]}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/video/fbdev/smscufx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "061cfeb560aa3ddc174153dbe5be9d0b55eb7248", "status": "affected", "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "versionType": "git"}, {"lessThan": "6167af934f956d3ae1e06d61f45cd0d1004bbe1a", "status": "affected", "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "versionType": "git"}, {"lessThan": "a0321e6e58facb39fe191caa0e52ed9aab6a48fe", "status": "affected", "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "versionType": "git"}, {"lessThan": "0634e8d650993602fc5b389ff7ac525f6542e141", "status": "affected", "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "versionType": "git"}, {"lessThan": "52917e265aa5f848212f60fc50fc504d8ef12866", "status": "affected", "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "versionType": "git"}, {"lessThan": "1c008ad0f0d1c1523902b9cdb08e404129677bfc", "status": "affected", "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "versionType": "git"}, {"lessThan": "f1e91bd4efeae48b0f42caed7e8ce2e3a0d05b02", "status": "affected", "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "versionType": "git"}, {"lessThan": "120adae7b42faa641179270c067864544a50ab69", "status": "affected", "version": "3c8a63e22a0802fd56380f6ab305b419f18eb6f5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/video/fbdev/smscufx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"lessThan": "3.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.251", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.201", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.164", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.127", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.74", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.13", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "RUGGEDCOM RST2428P", "vendor": "Siemens", "versions": [{"lessThan": "V4.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C8DBBBFC-9692-4C23-A5E0-8F01CB6789D1", "versionEndExcluding": "5.10.251", "versionStartIncluding": "3.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "600A89ED-86F2-48D8-BB7C-5EE7A8832FC5", "versionEndExcluding": "5.15.201", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6892F74B-3F14-4500-9652-24A2ECB04144", "versionEndExcluding": "6.1.164", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A9F36A3-A685-48A0-84B4-6217052BD058", "versionEndExcluding": "6.6.127", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C2968F55-D03F-42BE-A694-F0A37BC8CBE3", "versionEndExcluding": "6.12.74", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6BDEF9FB-423E-49F6-991B-9277CC3AF400", "versionEndExcluding": "6.18.13", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7853A337-FB2A-4E19-AB47-4E38343532AA", "versionEndExcluding": "6.19.3", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: smscufx: properly copy ioctl memory to kernelspace\n\nThe UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from\nuserspace to kernelspace, and instead directly references the memory,\nwhich can cause problems if invalid data is passed from userspace. Fix\nthis all up by correctly copying the memory before accessing it within\nthe kernel."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfbdev: smscufx: copiar correctamente la memoria ioctl al espacio del kernel\n\nEl ioctl UFX_IOCTL_REPORT_DAMAGE no copia correctamente los datos desde el espacio de usuario al espacio del kernel, y en su lugar referencia directamente la memoria, lo que puede causar problemas si se pasan datos inv\u00e1lidos desde el espacio de usuario. Soluciona todo esto copiando correctamente la memoria antes de acceder a ella dentro del kernel."}], "id": "CVE-2026-23236", "lastModified": "2026-06-17T10:21:09.573", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-03-04T15:16:14.173", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/061cfeb560aa3ddc174153dbe5be9d0b55eb7248"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0634e8d650993602fc5b389ff7ac525f6542e141"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/120adae7b42faa641179270c067864544a50ab69"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1c008ad0f0d1c1523902b9cdb08e404129677bfc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/52917e265aa5f848212f60fc50fc504d8ef12866"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6167af934f956d3ae1e06d61f45cd0d1004bbe1a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a0321e6e58facb39fe191caa0e52ed9aab6a48fe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f1e91bd4efeae48b0f42caed7e8ce2e3a0d05b02"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: fbdev: smscufx: properly copy ioctl memory to kernelspace", "id": "2444387", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444387"}, "csaw": false, "details": ["No description is available for this CVE."], "name": "CVE-2026-23236", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23236\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23236\nhttps://lore.kernel.org/linux-cve-announce/2026030440-CVE-2026-23236-b419@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,061cfeb560aa3ddc174153dbe5be9d0b55eb7248)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0634e8d650993602fc5b389ff7ac525f6542e141)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,120adae7b42faa641179270c067864544a50ab69)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1c008ad0f0d1c1523902b9cdb08e404129677bfc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,52917e265aa5f848212f60fc50fc504d8ef12866)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6167af934f956d3ae1e06d61f45cd0d1004bbe1a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a0321e6e58facb39fe191caa0e52ed9aab6a48fe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f1e91bd4efeae48b0f42caed7e8ce2e3a0d05b02)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.251,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.201,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.164,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.127,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.74,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.13,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.3,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-15T17:54:54.553520+00:00", "value": {"mitigation_remediation": ["Upgrade the kernel to a version that includes the smscufx ioctl copy fix (apply the relevant commit).", "If an immediate kernel update is not possible, unload or disable the smscufx framebuffer driver to eliminate the vulnerable interface.", "Restrict permissions on the smscufx device node so that only privileged users can invoke the ioctl, thereby reducing the attack surface.", "Monitor kernel logs for anomalous access or crashes that may indicate exploitation attempts."], "summary": {"action": "Patch", "impact": "Kernel memory corruption with potential privilege escalation"}, "threat_synthesis": {"affected_systems": "This issue affects the Linux kernel as a whole, specifically the smscufx framebuffer driver in the fbdev subsystem. All kernel releases lacking the commit that corrects the copy operation are potentially vulnerable, regardless of distribution or patch level.", "description_and_impact": "The smscufx framebuffer driver includes an ioctl, UFX_IOCTL_REPORT_DAMAGE, that is intended to copy data from user space into kernel memory before use. Instead, the implementation references the user pointer directly. Therefore, if an attacker supplies crafted data, the kernel may perform invalid memory accesses, corrupting kernel memory. Such corruption could allow arbitrary code execution or privilege escalation from a local user.", "risk_and_exploitability": "The CVSS score of 7.3 classifies the vulnerability as high severity, while an EPSS score of <1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no public exploitation has been reported. The attack vector is most likely local; an attacker with access to the /dev/smscufx device node can invoke the ioctl and supply malicious data, potentially leading to kernel memory corruption."}}}}, "created": "2026-03-04T21:03:23.612758+00:00", "updated": "2026-04-15T18:00:15.499418+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}