# CVE-2025-40323: fbcon: Set fb_display[i]->mode to NULL when the mode is released

> A use-after-free vulnerability in the Linux kernel's framebuffer console allows local attackers to potentially execute code or escalate privileges via crafted ioctl calls.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 8 Dec 2025
- **Updated:** 15 Oct 2026
- **Also known as:** BELL-CVE-2025-40323, DEBIAN-CVE-2025-40323, GHSA-vv6w-x7vv-rv35, ROOT-OS-DEBIAN-11-CVE-2025-40323, ROOT-OS-DEBIAN-12-CVE-2025-40323, ROOT-OS-DEBIAN-13-CVE-2025-40323, ROOT-OS-UBUNTU-2204-CVE-2025-40323, ROOT-OS-UBUNTU-2404-CVE-2025-40323, UBUNTU-CVE-2025-40323

## What is CVE-2025-40323?

CVE-2025-40323 is a high-severity use after free vulnerability in Linux, published on 8 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

fbcon: Set fb_display[i]->mode to NULL when the mode is released

Recently, we discovered the following issue through syzkaller:

BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0
Read of size 4 at addr ff11000001b3c69c by task syz.xxx
...
Call Trace:
 <TASK>
 dump_stack_lvl+0xab/0xe0
 print_address_description.constprop.0+0x2c/0x390
 print_report+0xb9/0x280
 kasan_report+0xb8/0xf0
 fb_mode_is_equal+0x285/0x2f0
 fbcon_mode_deleted+0x129/0x180
 fb_set_var+0xe7f/0x11d0
 do_fb_ioctl+0x6a0/0x750
 fb_ioctl+0xe0/0x140
 __x64_sys_ioctl+0x193/0x210
 do_syscall_64+0x5f/0x9c0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Based on experimentation and analysis, during framebuffer unregistration,
only the memory of fb_info->modelist is freed, without setting the
corresponding fb_display[i]->mode to NULL for the freed modes. This leads
to UAF issues during subsequent accesses. Here's an example of reproduction
steps:
1. With /dev/fb0 already registered in the system, load a kernel module
   to register a new device /dev/fb1;
2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);
3. Switch console from fb to VGA (to allow normal rmmod of the ko);
4. Unload the kernel module, at this point fb1's modelist is freed, leaving
   a wild pointer in fb_display[];
5. Trigger the bug via system calls through fb0 attempting to delete a mode
   from fb0.

Add a check in do_unregister_framebuffer(): if the mode to be freed exists
in fb_display[], set the corresponding mode pointer to NULL.

## Which versions are affected by CVE-2025-40323?


## How do I fix CVE-2025-40323?

Apply the vendor's patch.

## Is CVE-2025-40323 being exploited?

There is no known exploitation of CVE-2025-40323 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-40323 and fix it if it is affected.

What it is: CVE-2025-40323 is a high-severity use after free vulnerability in Linux, published on 8 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-40323 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-40323/ (Markdown: https://insights.sbomify.com/CVE-2025-40323/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-40323
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-40323
- OSV: https://osv.dev/vulnerability/CVE-2025-40323

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-40323/
Summaries are generated and may contain mistakes; the official description above is the record.