In the Linux kernel, the following vulnerability has been resolved:
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
If fb_add_videomode() in fb_set_var() fails to allocate memory for fb_videomode, later it may lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered while not having the mode in modelist that is expected to be there, i.e. the one that is described in fb_info->var.
================================================================ general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901 Call Trace: display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929 fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071 resize_screen drivers/tty/vt/vt.c:1176 [inline] vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263 fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720 fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776 do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128 fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 ================================================================
The reason is that fb_info->var is being modified in fb_set_var(), and then fb_videomode_to_var() is called. If it fails to add the mode to fb_info->modelist, fb_set_var() returns error, but does not restore the old value of fb_info->var. Restore fb_info->var on failure the same way it is done earlier in the function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade python-perfUpgrade perfUpgrade kernel-tools-develUpgrade bpftoolUpgrade kernel-livepatch-5.10.239-236.958Upgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.15.186-128.192Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade perf-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade kernel-livepatch-6.1.144-170.251Upgrade perfUpgrade perf6.12Upgrade python3-perf6.12-debuginfoUpgrade kernelUpgrade kernel-tools-develUpgrade python3-perfUpgrade perf-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-modules-extra-commonUpgrade perf6.12-debuginfoUpgrade kernel6.12-debuginfoUpgrade kernel-livepatch-6.12.35-55.103Upgrade kernel-headersUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel-libbpf-debuginfoUpgrade kernel-debuginfoUpgrade python3-perf-debuginfoUpgrade python3-perf6.12Upgrade bpftoolUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-modules-extraUpgrade kernel-libbpfUpgrade kernel-libbpf-staticUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-aarch64Upgrade kernel6.12 | Sep 9, 2025 | Jul 4, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jul 7, 2025 | Jul 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools | Oct 14, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-abi-stablelists | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade bpftoolUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel | Oct 24, 2025 | Oct 10, 2025 |
| Oracle_linux | — | Upgrade kernel-uek | Sep 10, 2025 | Jul 4, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 4, 2025 |
| Suse | — | Upgrade reiserfs-kmp-rtUpgrade kernel-obs-qaUpgrade dtb-amlogicUpgrade gfs2-kmp-64kbUpgrade kernel-docsUpgrade kernel-default-manUpgrade kernel-rt-develUpgrade kernel-rt_debug-vdsoUpgrade dtb-xilinxUpgrade kernel-zfcpdumpUpgrade dtb-apmUpgrade kernel-rt-livepatchUpgrade kernel-azure-vdsoUpgrade dtb-qcomUpgrade dtb-socionextUpgrade kernel-default-extraUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-develUpgrade kernel-symsUpgrade kernel-kvmsmallUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-devel-rtUpgrade dtb-armUpgrade kernel-64kbUpgrade dtb-amdUpgrade dtb-hisiliconUpgrade kernel-debug-develUpgrade dlm-kmp-azureUpgrade kernel-debugUpgrade kernel-syms-rtUpgrade kernel-default-optionalUpgrade kselftests-kmp-defaultUpgrade kselftests-kmp-rtUpgrade kernel-macrosUpgrade kernel-rtUpgrade cluster-md-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade ocfs2-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-syms-azureUpgrade kernel-azure-develUpgrade dtb-mediatekUpgrade kernel-devel-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-rt-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-default-vdsoUpgrade dtb-caviumUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kernel-sourceUpgrade dtb-lgUpgrade ocfs2-kmp-azureUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-extraUpgrade kernel-default-livepatchUpgrade kernel-default-base-rebuildUpgrade dtb-sprdUpgrade dtb-appleUpgrade kernel-default-develUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-source-rtUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-defaultUpgrade gfs2-kmp-azureUpgrade dtb-alteraUpgrade dtb-marvellUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-extraUpgrade dtb-renesasUpgrade dtb-amazonUpgrade kernel-rt_debugUpgrade kernel-default-baseUpgrade dtb-exynosUpgrade dtb-allwinnerUpgrade dlm-kmp-rtUpgrade kernel-obs-buildUpgrade kernel-develUpgrade kernel-defaultUpgrade kernel-azure-optionalUpgrade kernel-64kb-extraUpgrade kernel-debug-vdsoUpgrade kernel-azureUpgrade dtb-rockchipUpgrade dtb-nvidiaUpgrade dtb-broadcomUpgrade dlm-kmp-64kb | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-xilinxUpgrade linux-image-generic-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-realtimeUpgrade linux-image-gkeopUpgrade linux-image-gke-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-oem-22.04Upgrade linux-image-gkeUpgrade linux-image-gcpUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-lowlatency-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oracle-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-gke-64k-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-virtual-6.14Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-virtual-6.8Upgrade linux-image-6.14.0-34-genericUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-azureUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.14.0-34-generic-64kUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-genericUpgrade linux-image-nvidiaUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1046-nvidia | Jul 9, 2025 | Jul 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 16, 2025 | Jul 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub