CVE-2025-40323 describes a use-after-free vulnerability in the Linux kernel's framebuffer console (fbcon) code. When framebuffer devices are unregistered, the memory for fb_info->modelist is freed, but the corresponding fb_display[i]->mode pointers are not cleared, leaving dangling pointers. Subsequent operations that access these stale pointers can cause use-after-free errors, leading to potential kernel crashes or arbitrary code execution. The issue was discovered via syzkaller fuzzing and involves manipulating framebuffer devices (/dev/fb0, /dev/fb1) and console switching. The fix involves adding a check in do_unregister_framebuffer() to set fb_display[i]->mode to NULL when the mode is freed.

This vulnerability allows local attackers with limited privileges to trigger use-after-free conditions in kernel memory, potentially leading to kernel crashes (denial of service) or escalation of privileges due to memory corruption. The CVSS vector indicates high impact on confidentiality, integrity, and availability. However, exploitation requires local access and specific framebuffer device manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates a code fix was made to set fb_display[i]->mode to NULL during framebuffer unregistration. Users should monitor official Linux kernel advisories and update to a kernel version that includes this fix once available. Until then, avoid loading/unloading framebuffer kernel modules unnecessarily and restrict local access to framebuffer devices to trusted users.