In the Linux kernel, the following vulnerability has been resolved:
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
If fb_add_videomode() in fb_set_var() fails to allocate memory for fb_videomode, later it may lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered while not having the mode in modelist that is expected to be there, i.e. the one that is described in fb_info->var.
================================================================ general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901 Call Trace: display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929 fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071 resize_screen drivers/tty/vt/vt.c:1176 [inline] vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263 fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720 fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776 do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128 fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 ================================================================
The reason is that fb_info->var is being modified in fb_set_var(), and then fb_videomode_to_var() is called. If it fails to add the mode to fb_info->modelist, fb_set_var() returns error, but does not restore the old value of fb_info->var. Restore fb_info->var on failure the same way it is done earlier in the function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.239-236.958Upgrade bpftool-debuginfoUpgrade perfUpgrade kernel-livepatch-5.15.186-128.192Upgrade kernel-toolsUpgrade kernel-develUpgrade python-perf | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.12.35-55.103Upgrade kernel-headersUpgrade kernel6.12-debuginfoUpgrade perf6.12Upgrade perfUpgrade python3-perf6.12-debuginfoUpgrade kernel-livepatch-6.1.144-170.251Upgrade python3-perfUpgrade kernel-modules-extra-commonUpgrade kernel-toolsUpgrade kernel-libbpf-develUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade perf6.12-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade bpftoolUpgrade python3-perf6.12Upgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernel-libbpfUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel6.12-modules-extraUpgrade kernel6.12Upgrade kernel-develUpgrade python3-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-libbpf-debuginfo | Sep 9, 2025 | Jul 4, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jul 7, 2025 | Jul 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-tools | Oct 14, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-toolsUpgrade python3-perf | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel | Oct 24, 2025 | Oct 10, 2025 |
| Oracle_linux | — | Upgrade kernel-uek | Sep 10, 2025 | Jul 4, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 4, 2025 |
| Suse | — | Upgrade dtb-rockchipUpgrade kernel-azureUpgrade kernel-source-vanillaUpgrade ocfs2-kmp-64kbUpgrade kernel-source-azureUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade dtb-alteraUpgrade ocfs2-kmp-defaultUpgrade dtb-caviumUpgrade dtb-sprdUpgrade kernel-default-base-rebuildUpgrade dtb-appleUpgrade kernel-default-livepatchUpgrade dtb-allwinnerUpgrade dtb-exynosUpgrade kernel-rt-extraUpgrade kernel-default-vdsoUpgrade kernel-azure-optionalUpgrade kernel-obs-buildUpgrade kernel-64kb-extraUpgrade kernel-defaultUpgrade kernel-rt_debugUpgrade dtb-amazonUpgrade dtb-renesasUpgrade kernel-develUpgrade dtb-freescaleUpgrade dtb-lgUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kernel-default-baseUpgrade dlm-kmp-rtUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-defaultUpgrade kernel-sourceUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade kselftests-kmp-azureUpgrade kernel-default-develUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-64kbUpgrade dtb-broadcomUpgrade reiserfs-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-debug-vdsoUpgrade kernel-docs-htmlUpgrade gfs2-kmp-azureUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-optionalUpgrade kernel-rt-vdsoUpgrade dtb-marvellUpgrade dtb-mediatekUpgrade kernel-docsUpgrade kernel-default-optionalUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-rtUpgrade dtb-armUpgrade kernel-symsUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmallUpgrade kernel-devel-rtUpgrade kernel-debugUpgrade reiserfs-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-rtUpgrade kernel-default-extraUpgrade dtb-amlogicUpgrade kernel-obs-qaUpgrade kselftests-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-debug-develUpgrade kernel-64kbUpgrade dtb-hisiliconUpgrade dlm-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade kernel-64kb-develUpgrade kernel-azure-vdsoUpgrade kernel-syms-rtUpgrade kernel-syms-azureUpgrade dlm-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade dtb-socionextUpgrade kernel-zfcpdumpUpgrade kernel-rt-livepatchUpgrade dtb-qcomUpgrade dtb-apmUpgrade kernel-rt-develUpgrade kernel-default-manUpgrade gfs2-kmp-64kbUpgrade kernel-macrosUpgrade dtb-xilinxUpgrade dtb-amdUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kernel-rt | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-lowlatency-64kUpgrade linux-image-aws-lts-24.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-generic-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-azure-fips-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-fips-6.8Upgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-oracle-6.8Upgrade linux-image-virtualUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-aws-64kUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-virtual-6.14Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-realtimeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-gcpUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-gkeUpgrade linux-image-oracle-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-nvidiaUpgrade linux-image-genericUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-oem-22.04bUpgrade linux-image-azure-6.8Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-xilinxUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-generic-64kUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-raspi-realtimeUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-aws-fipsUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-6.14.0-34-genericUpgrade linux-image-aws-fips-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-xilinx-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-awsUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-ibmUpgrade linux-image-generic-64k-6.8Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-fipsUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-ibm-6.8Upgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.14.0-34-generic-64kUpgrade linux-image-realtime-6.8.1Upgrade linux-image-raspiUpgrade linux-image-generic-6.14Upgrade linux-image-azure-fipsUpgrade linux-image-azureUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-generic-64k-6.14Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-gke-64kUpgrade linux-image-oracleUpgrade linux-image-raspi-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-gcp-fipsUpgrade linux-image-gcp-64k-lts-24.04 | Jul 9, 2025 | Jul 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 16, 2025 | Jul 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub