fbcon: fix NULL pointer dereference for a console without vc_data (Linux Linux)

CVE-2026-74424
Not available

At a glance

Source
NVD
EPSS
EPSS 0.16 % · percentile 5 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Received

Description

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vc_data fbcon_new_modelist() runs when a framebuffer's modelist changes. For each console mapped to it with fb_display[i].mode set, it reads vc_cons[i].d and passes the vc_num to fbcon_set_disp(). This assumes a console with a mode set has a vc_data, but it can be NULL. fbcon_set_disp() sets fb_display[i].mode before it checks vc_data, and fbcon_deinit() leaves the mode set after the vc_data is freed. fbcon_new_modelist() then dereferences the NULL vc_data. Keep fb_display[i].mode set only while the console has a vc_data. Check vc_data before setting the mode in fbcon_set_disp(), and clear the mode in fbcon_deinit(). The existing mode check in fbcon_new_modelist() then skips such consoles.

References

European references

CERT-FR advisories

Affected products

ProductVersions
Linux · Linuxaffected d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e < 8e9b8b008f4036df0318870c5d754134ff1b94cc ; affected d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e < cc4382dc5134826a3936a6b08de17f7dc7abe232 ; affected d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e < 9b783b7e03dc78ec102edf618259a2b55911fc6a ; affected d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e < ac970358c5ca0775841bd2a56ce15dc464b99003 ; affected d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e < 6617df8c246311c82cebf061a4cee55b9df60922 ; affected d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e < b134ad2f7c06b3c1098dcc95008e2045ff4b49b2
Linux · Linuxaffected 2.6.23 ; unaffected 0 < 2.6.23 ; unaffected 5.15.212 ≤ 5.15.* ; unaffected 6.1.178 ≤ 6.1.* ; unaffected 6.6.145 ≤ 6.6.* ; unaffected 6.12.97 ≤ 6.12.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD