The Linux kernel framebuffer device (fbdev) subsystem had a use-after-free vulnerability in the store_modes() function. When store_modes() replaces the framebuffer's mode list with a new one, it frees the old list but leaves two pointers (fb_display[i].mode and fb_info->mode) referencing the freed memory. fb_display[i].mode pointers for unmapped consoles remain stale, leading to use-after-free when accessed by FBIOPUT_VSCREENINFO ioctl with FB_ACTIVATE_INV_MODE. Similarly, fb_info->mode is not updated and remains stale, causing use-after-free when read via the mode sysfs attribute. The fix clears these pointers before freeing the old list, preventing dereferencing of freed memory.

The vulnerability allows use-after-free reads in the framebuffer device subsystem, which could lead to kernel memory corruption or crashes if exploited. No known exploits are reported in the wild. The impact is limited to local interactions with framebuffer modes via ioctl or sysfs interfaces.

A fix has been implemented in the Linux kernel that clears the stale pointers before freeing the old mode list in store_modes(). Users should apply the official kernel update containing this fix. Since this is a kernel vulnerability, upgrading to a patched kernel version is the recommended mitigation. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel mailing list advisories for the exact fixed versions and updates.