---
id: CVE-2026-46065
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info

  Hold state of deferred I/O in struct fb_deferred_io_state
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info

  Hold state of deferred I/O in struct fb_deferred_io_state. Allocate an
  instance as part of in…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-401
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.22, < 5.15.210'
  - 'linux_kernel >= 5.16, < 6.1.176'
  - 'linux_kernel >= 6.2, < 6.6.140'
  - 'linux_kernel >= 6.7, < 6.12.88'
  - 'linux_kernel >= 6.13, < 6.18.30'
  - 'linux_kernel >= 6.19, < 7.0.4'
patched:
  - linux_kernel 7.0.4
published: '2026-05-27'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:19:41.253'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46065'
references:
  - url: 'https://git.kernel.org/stable/c/25c2b77bc463f29ee71a54b883548baf9386a0db'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2a40f8bc9bb713329f1c35ffc199ee961a7135b0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2b53d3a52e8e5403a4f4fb57ac6cad3fd2cb1066'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4aab89603b637a2e441b38808c4f6fe7d1184df6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4fda0d6b45faad44926dd3e4f55f118d899b2e27'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9ded47ad003f09a94b6a710b5c47f4aa5ceb7429'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a0aafb421dd15e935d81543152617f2742cefa70'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00129
epssPercentile: 0.02266
ingestedAt: '2026-10-15T03:30:12.885Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info

Hold state of deferred I/O in struct fb_deferred_io_state. Allocate an
instance as part of initializing deferred I/O and remove it only after
the final mapping has been closed. If the fb_info and the contained
deferred I/O meanwhile goes away, clear struct fb_deferred_io_state.info
to invalidate the mapping. Any access will then result in a SIGBUS
signal.

Fixes a long-standing problem, where a device hot-unplug happens while
user space still has an active mapping of the graphics memory. The hot-
unplug frees the instance of struct fb_info. Accessing the memory will
operate on undefined state.

## Affected

- `linux_kernel >= 2.6.22, < 5.15.210`
- `linux_kernel >= 5.16, < 6.1.176`
- `linux_kernel >= 6.2, < 6.6.140`
- `linux_kernel >= 6.7, < 6.12.88`
- `linux_kernel >= 6.13, < 6.18.30`
- `linux_kernel >= 6.19, < 7.0.4`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.4`