In the Linux kernel, the following vulnerability has been resolved:
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
If fb_add_videomode() in fb_set_var() fails to allocate memory for fb_videomode, later it may lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered while not having the mode in modelist that is expected to be there, i.e. the one that is described in fb_info->var.
================================================================ general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901 Call Trace: display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929 fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071 resize_screen drivers/tty/vt/vt.c:1176 [inline] vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263 fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720 fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776 do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128 fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 ================================================================
The reason is that fb_info->var is being modified in fb_set_var(), and then fb_videomode_to_var() is called. If it fails to add the mode to fb_info->modelist, fb_set_var() returns error, but does not restore the old value of fb_info->var. Restore fb_info->var on failure the same way it is done earlier in the function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade perfUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.186-128.192Upgrade kernel-develUpgrade bpftoolUpgrade kernel-livepatch-5.10.239-236.958Upgrade bpftool-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-develUpgrade perf6.12-debuginfoUpgrade kernelUpgrade kernel-headersUpgrade kernel-modules-extra-commonUpgrade kernel6.12-debuginfoUpgrade kernel-toolsUpgrade python3-perf6.12-debuginfoUpgrade kernel-livepatch-6.1.144-170.251Upgrade perf6.12Upgrade kernel-livepatch-6.12.35-55.103Upgrade perfUpgrade perf-debuginfoUpgrade python3-perfUpgrade kernel-tools-develUpgrade python3-perf-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-libbpf-debuginfoUpgrade kernel-debuginfoUpgrade python3-perf6.12Upgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-libbpf-staticUpgrade kernel-libbpfUpgrade kernel6.12-modules-extraUpgrade kernel-develUpgrade kernel6.12 | Sep 9, 2025 | Jul 4, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jul 7, 2025 | Jul 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-perfUpgrade kernelUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-tools | Oct 14, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade bpftool | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools-libs | Oct 24, 2025 | Oct 10, 2025 |
| Oracle_linux | — | Upgrade kernel-uek | Sep 10, 2025 | Jul 4, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 4, 2025 |
| Suse | — | Upgrade kernel-debugUpgrade kernel-kvmsmallUpgrade kernel-kvmsmall-develUpgrade dtb-socionextUpgrade kernel-docsUpgrade kernel-symsUpgrade dtb-apmUpgrade kernel-rt-livepatchUpgrade kernel-zfcpdumpUpgrade dtb-qcomUpgrade dtb-armUpgrade kernel-64kb-optionalUpgrade dtb-mediatekUpgrade kernel-64kb-develUpgrade kernel-64kbUpgrade kernel-azure-develUpgrade dtb-xilinxUpgrade gfs2-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-devel-azureUpgrade ocfs2-kmp-rtUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-defaultUpgrade dtb-amdUpgrade kernel-syms-azureUpgrade kselftests-kmp-rtUpgrade kernel-macrosUpgrade gfs2-kmp-64kbUpgrade kernel-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-manUpgrade kernel-rt-develUpgrade dtb-hisiliconUpgrade kernel-debug-develUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-azure-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-devel-rtUpgrade dtb-amlogicUpgrade kernel-obs-qaUpgrade kernel-default-extraUpgrade kernel-syms-rtUpgrade kselftests-kmp-64kbUpgrade dtb-lgUpgrade dtb-exynosUpgrade kernel-obs-buildUpgrade dtb-freescaleUpgrade dtb-allwinnerUpgrade kernel-default-livepatchUpgrade kernel-default-base-rebuildUpgrade dtb-rockchipUpgrade kernel-rt_debug-develUpgrade kernel-default-develUpgrade kselftests-kmp-azureUpgrade kernel-source-rtUpgrade kernel-sourceUpgrade ocfs2-kmp-azureUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-develUpgrade kernel-defaultUpgrade kernel-azure-optionalUpgrade kernel-64kb-extraUpgrade dtb-sprdUpgrade dtb-appleUpgrade dtb-alteraUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-extraUpgrade kernel-rt_debugUpgrade dtb-renesasUpgrade dtb-amazonUpgrade kernel-default-baseUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-extraUpgrade gfs2-kmp-defaultUpgrade gfs2-kmp-azureUpgrade kernel-source-vanillaUpgrade dtb-marvellUpgrade cluster-md-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade kernel-source-azureUpgrade dtb-caviumUpgrade kernel-default-vdsoUpgrade kernel-docs-htmlUpgrade kernel-debug-vdsoUpgrade dtb-nvidiaUpgrade dtb-broadcomUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade kernel-azure | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-realtime-6.8.1Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-raspiUpgrade linux-image-azureUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-oem-22.04dUpgrade linux-image-xilinx-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-ibm-classicUpgrade linux-image-ibm-6.8Upgrade linux-image-6.14.0-34-generic-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-ibmUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-oem-22.04aUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-generic-64k-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-generic-6.14Upgrade linux-image-generic-64k-6.14Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-azure-fipsUpgrade linux-image-6.14.0-34-genericUpgrade linux-image-lowlatency-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-gke-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-gcp-64kUpgrade linux-image-aws-fipsUpgrade linux-image-gcp-fipsUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-kvmUpgrade linux-image-gcp-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-aws-6.8Upgrade linux-image-awsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-fipsUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-oracle-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-xilinxUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-virtual-6.14Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-genericUpgrade linux-image-nvidiaUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-gke-64k-6.8Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-oem-22.04cUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-gkeUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-gcpUpgrade linux-image-generic-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-realtimeUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-gkeopUpgrade linux-image-gke-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-oem-22.04bUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-azure-6.8 | Jul 9, 2025 | Jul 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 16, 2025 | Jul 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub