Hi Co,
On Thu, 27 Aug 2026 at 14:43, co <[email protected]> wrote:
> We found a bug reachable in:
>
> path drivers/video/fbdev/core/fb_chrdev.c`, `drivers/video/fbdev/core
> crash use-after-free in _copy_to_user()
> commit 843bc34db94b
>
> Config, environment, the sanitizer report and a C reproducer follow.
>
> == Notes ===============================================================
> If you patch the bug based on our artifacts, a tag would be
> appreciated:
>
> Reported-by: [email protected]
>
> Everything in this mail is validated by the reproducer below.
>
> We also hold an LLM-generated root-cause analysis and a candidate
> patch. The patch passes an A/B test: the same reproducer panics the
> unpatched kernel and runs clean on the patched one. Neither has had
> human review, so both still require validation before you send or
> apply them. Available on:
>
> patch.diff https://bugs.sh/b/c25629c98ba36ebe/patch.diff
> report.md https://bugs.sh/b/c25629c98ba36ebe/report.md
Thanks for your patch, but both links are almost empty:
No artifacts published for c25629c98ba36ebe yet.
Request them from [email protected], quoting the bug id.
> This is an open science project. The code and the full set of PoCs
> are not public at this moment, as we intend to disclose our findings
> in an ethical way.
Please read Documentation/process/submitting-patches.rst
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected]
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
