Security readout for executives and security teams
Plain-English summary
A Linux framebuffer driver uses caller-controlled memory directly when processing damage reports instead of first copying it into kernel memory. A low-privileged local user with device access may supply invalid data, potentially compromising system integrity or availability. This is not described as a remote vulnerability.
Executive priority
Treat this as a high-priority local privilege-boundary issue on exposed multi-user systems and products using smscufx hardware. Accelerate patching where untrusted users or workloads can access the framebuffer device. Systems without the driver or accessible device interface have substantially lower urgency based on the supplied evidence.
Technical view
The smscufx UFX_IOCTL_REPORT_DAMAGE handler improperly references userspace memory. Listed stable commits copy the data before kernel access. The CVSS 3.1 score is 7.3: local, low-complexity, low-privilege exploitation requiring no user interaction, with modeled low confidentiality and high integrity and availability impact.
Likely exposure
Exposure is limited to Linux systems where the smscufx framebuffer driver is present and a low-privileged local user can reach the affected ioctl. The supplied version data is ambiguous and should not be treated as a reliable range; confirm each distribution kernel's backport status.
Exploitation context
The supplied record marks KEV false, and no cited source reports active exploitation or a public exploit. Exploitation requires local access, low privileges, and access to the affected driver interface. Absence of reported exploitation does not establish that exploitation is impossible.
Researcher notes
The remediation changes userspace-data handling in the ioctl path. No CWE is assigned, and the bundle provides no crash trace, proof of concept, or confirmed exploitation. The affected-version list contains ambiguous entries and repeated commit hashes; validate commit ancestry and downstream backports rather than relying on those strings alone.
Mitigation direction
- Apply a distribution or vendor kernel update containing the appropriate listed stable fix.
- Prioritize multi-user or appliance systems where untrusted local users can access smscufx devices.
- Until updated, restrict untrusted local access to affected framebuffer devices where operationally safe.
- Review vendor advisories for branch-specific fixed versions, backports, and reboot requirements.
Validation and detection
- Inventory kernels with the smscufx driver built, installed, or loaded.
- Determine whether untrusted local users can access the associated framebuffer device and ioctl.
- Match distribution changelogs or kernel source against one of the listed stable fix commits.
- Confirm the running kernel after updating, including any required reboot.
- Review monitoring for related kernel faults without attempting malformed-input exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23236 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/061cfeb560aa3ddc174153dbe5be9d0b55eb7248CVE reference, Linux
- https://git.kernel.org/stable/c/6167af934f956d3ae1e06d61f45cd0d1004bbe1aCVE reference, Linux
- https://git.kernel.org/stable/c/a0321e6e58facb39fe191caa0e52ed9aab6a48feCVE reference, Linux
- https://git.kernel.org/stable/c/0634e8d650993602fc5b389ff7ac525f6542e141CVE reference, Linux
- https://git.kernel.org/stable/c/52917e265aa5f848212f60fc50fc504d8ef12866CVE reference, Linux
- https://git.kernel.org/stable/c/1c008ad0f0d1c1523902b9cdb08e404129677bfcCVE reference, Linux
- https://git.kernel.org/stable/c/f1e91bd4efeae48b0f42caed7e8ce2e3a0d05b02CVE reference, Linux
- https://git.kernel.org/stable/c/120adae7b42faa641179270c067864544a50ab69CVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-253495.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.