PT-2026-61108 · Linux · Linux
CVE-2026-53403
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
fbdev: Fix fb new modelist to prevent null-ptr-deref in fb videomode to var
info->var, a framebuffer's current mode, is expected to have a matching
entry in info->modelist. var to display() relies on this and treats a
failed fb match mode() as "This should not happen". fb set var() keeps it
true by adding the mode to the list on every change, and
do register framebuffer() does the same at registration.
store modes() replaces the modelist from userspace. fb new modelist()
validates the new modes but does not check that info->var still has a
match. It relies on fbcon new modelist() to re-point consoles, but that
only handles consoles mapped to the framebuffer. With fbcon unbound there
are none, so info->var is left describing a mode that is no longer in the
list.
A later console takeover runs var to display(), where fb match mode()
returns NULL and leaves fb display[i].mode NULL. fbcon switch() passes it
to display to var(), and fb videomode to var() dereferences the NULL mode.
Keep the current mode in the list in fb new modelist(), the same way
fb set var() does.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux