Medium severity · published Mar 4, 2026
CVE-2026-23236
fbdev: smscufx: properly copy ioctl memory to kernelspace
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
fbdev: smscufx: properly copy ioctl memory to kernelspace
The UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from
userspace to kernelspace, and instead directly references the memory,
which can cause problems if invalid data is passed from userspace. Fix
this all up by correctly copying the memory before accessing it within
the kernel.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
3.2 before 5.10.251; 5.11 before 5.15.201; 5.16 before 6.1.164; 6.2 before 6.6.127; 6.7 before 6.12.74; 6.13 before 6.18.13; +1 more · source: NVD
LI
Linux · Linux
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 before 061cfeb560aa3ddc174153dbe5be9d0b55eb7248; 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 before 6167af934f956d3ae1e06d61f45cd0d1004bbe1a; 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 before a0321e6e58facb39fe191caa0e52ed9aab6a48fe; 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 before 0634e8d650993602fc5b389ff7ac525f6542e141; 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 before 52917e265aa5f848212f60fc50fc504d8ef12866; 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 before 1c008ad0f0d1c1523902b9cdb08e404129677bfc; +3 more · source: vendor
RR
RUGGEDCOM RST2428P · Siemens
before V4.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23236
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23236
Patch
https://git.kernel.org/stable/c/061cfeb560aa3ddc174153dbe5be9d0b55eb7248
Patch
https://git.kernel.org/stable/c/0634e8d650993602fc5b389ff7ac525f6542e141
Patch
https://git.kernel.org/stable/c/120adae7b42faa641179270c067864544a50ab69
Patch
https://git.kernel.org/stable/c/1c008ad0f0d1c1523902b9cdb08e404129677bfc
Patch
https://git.kernel.org/stable/c/52917e265aa5f848212f60fc50fc504d8ef12866
Patch
https://git.kernel.org/stable/c/6167af934f956d3ae1e06d61f45cd0d1004bbe1a
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability