PT-2026-61108 · Linux · Linux
CVE-2026-53403
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
fbdev: Fix fb new modelist to prevent null-ptr-deref in fb videomode to var
info->var, a framebuffer's current mode, is expected to have a matching
entry in info->modelist. var to display() relies on this and treats a
failed fb match mode() as "This should not happen". fb set var() keeps it
true by adding the mode to the list on every change, and
do register framebuffer() does the same at registration.
store modes() replaces the modelist from userspace. fb new modelist()
validates the new modes but does not check that info->var still has a
match. It relies on fbcon new modelist() to re-point consoles, but that
only handles consoles mapped to the framebuffer. With fbcon unbound there
are none, so info->var is left describing a mode that is no longer in the
list.
A later console takeover runs var to display(), where fb match mode()
returns NULL and leaves fb display[i].mode NULL. fbcon switch() passes it
to display to var(), and fb videomode to var() dereferences the NULL mode.
Keep the current mode in the list in fb new modelist(), the same way
fb set var() does.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux