CVE-2026-43497

In the Linux kernel, the following vulnerability has been resolved:

fbdev: udlfb: add vmops to dlfbops_mmap to prevent use-after-free

dlfbopsmmap() uses remappfnrange() to map vmalloc framebuffer pages to userspace but sets no vmops on the VMA. This means the kernel cannot track active mmaps. When dlfbreallocframebuffer() replaces the backing buffer via FBIOPUTVSCREENINFO, existing mmap PTEs are not invalidated. On USB disconnect, dlfbopsdestroy() calls vfree() on the old pages while userspace PTEs still reference them, resulting in a use-after-free: the process retains read/write access to freed kernel pages.

Add vmoperationsstruct with open/close callbacks that maintain an atomic mmapcount on struct dlfbdata. In dlfbreallocframebuffer(), check mmap_count and return -EBUSY if the buffer is currently mapped, preventing buffer replacement while userspace holds stale PTEs.

Tested with PoC using dummyhcd + rawgadget USB device emulation.