In the Linux kernel, the following vulnerability has been resolved:
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
If fb_add_videomode() in fb_set_var() fails to allocate memory for fb_videomode, later it may lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered while not having the mode in modelist that is expected to be there, i.e. the one that is described in fb_info->var.
================================================================ general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901 Call Trace: display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929 fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071 resize_screen drivers/tty/vt/vt.c:1176 [inline] vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263 fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720 fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776 do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128 fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 ================================================================
The reason is that fb_info->var is being modified in fb_set_var(), and then fb_videomode_to_var() is called. If it fails to add the mode to fb_info->modelist, fb_set_var() returns error, but does not restore the old value of fb_info->var. Restore fb_info->var on failure the same way it is done earlier in the function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade python-perfUpgrade kernel-livepatch-5.10.239-236.958Upgrade kernel-develUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-livepatch-5.15.186-128.192Upgrade perfUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-debuginfoUpgrade perfUpgrade perf6.12Upgrade kernel-modules-extra-commonUpgrade kernel-livepatch-6.12.35-55.103Upgrade kernel-headersUpgrade kernel-libbpf-develUpgrade kernel-livepatch-6.1.144-170.251Upgrade perf6.12-debuginfoUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-debuginfo-common-aarch64Upgrade python3-perf6.12Upgrade bpftoolUpgrade kernel-modules-extraUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel6.12-modules-extraUpgrade kernel-libbpfUpgrade kernel-libbpf-staticUpgrade kernel6.12Upgrade kernel-debuginfo-common-x86_64Upgrade python3-perf-debuginfoUpgrade kernel-libbpf-debuginfoUpgrade kernel-debuginfo | Sep 9, 2025 | Jul 4, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jul 7, 2025 | Jul 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-abi-stablelists | Oct 14, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perfUpgrade bpftool | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | Oct 24, 2025 | Oct 10, 2025 |
| Oracle_linux | — | Upgrade kernel-uek | Sep 10, 2025 | Jul 4, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 4, 2025 |
| Suse | — | Upgrade kernel-rt-vdsoUpgrade dtb-sprdUpgrade kernel-sourceUpgrade kernel-default-develUpgrade cluster-md-kmp-rtUpgrade dtb-marvellUpgrade reiserfs-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-default-livepatchUpgrade kernel-rt-extraUpgrade gfs2-kmp-defaultUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-defaultUpgrade dtb-rockchipUpgrade dtb-alteraUpgrade dtb-nvidiaUpgrade kernel-azureUpgrade dtb-appleUpgrade kernel-azure-extraUpgrade dlm-kmp-64kbUpgrade kernel-docs-htmlUpgrade dtb-broadcomUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-64kbUpgrade dtb-caviumUpgrade kernel-default-livepatch-develUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-azureUpgrade dtb-freescaleUpgrade dtb-lgUpgrade ocfs2-kmp-defaultUpgrade dtb-amazonUpgrade dtb-renesasUpgrade kernel-azure-optionalUpgrade kernel-rt_debugUpgrade kernel-develUpgrade dtb-allwinnerUpgrade kernel-default-baseUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-rtUpgrade kernel-obs-buildUpgrade kselftests-kmp-azureUpgrade dtb-exynosUpgrade kernel-rt_debug-develUpgrade kernel-source-rtUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-extraUpgrade kernel-source-azureUpgrade kernel-defaultUpgrade kernel-source-vanillaUpgrade kernel-rtUpgrade reiserfs-kmp-azureUpgrade kernel-devel-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-kvmsmallUpgrade dtb-mediatekUpgrade kernel-debugUpgrade kernel-64kb-optionalUpgrade kernel-zfcpdumpUpgrade kernel-rt-livepatchUpgrade dtb-socionextUpgrade dtb-qcomUpgrade dtb-apmUpgrade kernel-obs-qaUpgrade dtb-amlogicUpgrade kernel-default-extraUpgrade kernel-macrosUpgrade kernel-docsUpgrade kernel-default-optionalUpgrade gfs2-kmp-rtUpgrade dtb-amdUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kernel-azure-vdsoUpgrade kernel-syms-rtUpgrade kernel-default-manUpgrade kernel-rt-develUpgrade kernel-debug-develUpgrade kernel-64kbUpgrade dtb-hisiliconUpgrade dlm-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade dlm-kmp-defaultUpgrade kernel-symsUpgrade dtb-xilinxUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade kernel-azure-develUpgrade kernel-kvmsmall-develUpgrade kernel-devel-rtUpgrade dtb-armUpgrade kernel-syms-azure | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-virtual-6.8Upgrade linux-image-ibmUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-azure-fipsUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-100-genericUpgrade linux-image-generic-6.14Upgrade linux-image-oem-22.04aUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-aws-64k-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-azureUpgrade linux-image-generic-64k-6.8Upgrade linux-image-generic-64k-6.14Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-ibm-classicUpgrade linux-image-xilinx-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-ibm-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-awsUpgrade linux-image-6.14.0-34-generic-64kUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-fipsUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-gke-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-raspi-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-realtime-6.8.1Upgrade linux-image-gcp-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-aws-fipsUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-6.14.0-34-genericUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-6.8Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-oracleUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-nvidia-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-gcp-fipsUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-gkeopUpgrade linux-image-genericUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-aws-64kUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oracle-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-6.8.0-1046-azureUpgrade linux-image-virtual-6.14Upgrade linux-image-virtualUpgrade linux-image-gke-64k-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-oracle-64kUpgrade linux-image-nvidiaUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-azure-fips-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-oem-22.04bUpgrade linux-image-xilinxUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-nvidia-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-gkeUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-gcpUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.8.0-1047-raspi | Jul 9, 2025 | Jul 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 16, 2025 | Jul 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub