CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

fbdev: modedb: fix a possible UAF in fb_find_mode()

If mode_option is NULL, it is assigned from mode_option_buf:

  if (!mode_option) {
    fb_get_options(NULL, &mode_option_buf);
    mode_option = mode_option_buf;
  }

Later, name is assigned from mode_option:

  const char *name = mode_option;

However, mode_option_buf is freed before name is no longer used:

  kfree(mode_option_buf);

while name is still accessed by:

  if ((name_matches(db[i], name, namelen) ||

Since name aliases mode_option_buf, this may result in a
use-after-free.

Fix this by extending the lifetime of mode_option_buf until the end of the
function by using scope-based resource management for cleanup.

The Linux kernel CVE team has assigned CVE-2026-64245 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.6.144 with commit c7dc382439f7b019e207055b52e9cec051d42fa9
	Fixed in 6.12.95 with commit f906347d75c7fc377041c6d3c535d0f08846aada
	Fixed in 6.18.38 with commit 4d418cf8daf57e454b4d855bf9b2419fd8e6a540
	Fixed in 7.1.3 with commit 13b6f0cdd5cd5e60f682ec43134ab0e2024bd356
	Fixed in 7.2-rc1 with commit 85b6256469cebdac395e7447147e06b2e151014f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64245
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/video/fbdev/core/modedb.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c7dc382439f7b019e207055b52e9cec051d42fa9
	https://git.kernel.org/stable/c/f906347d75c7fc377041c6d3c535d0f08846aada
	https://git.kernel.org/stable/c/4d418cf8daf57e454b4d855bf9b2419fd8e6a540
	https://git.kernel.org/stable/c/13b6f0cdd5cd5e60f682ec43134ab0e2024bd356
	https://git.kernel.org/stable/c/85b6256469cebdac395e7447147e06b2e151014f