In the Linux kernel, the following vulnerability has been resolved:
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
If fb_add_videomode() in fb_set_var() fails to allocate memory for fb_videomode, later it may lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered while not having the mode in modelist that is expected to be there, i.e. the one that is described in fb_info->var.
================================================================ general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901 Call Trace: display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929 fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071 resize_screen drivers/tty/vt/vt.c:1176 [inline] vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263 fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720 fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776 do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128 fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 ================================================================
The reason is that fb_info->var is being modified in fb_set_var(), and then fb_videomode_to_var() is called. If it fails to add the mode to fb_info->modelist, fb_set_var() returns error, but does not restore the old value of fb_info->var. Restore fb_info->var on failure the same way it is done earlier in the function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade kernel-develUpgrade kernel-livepatch-5.10.239-236.958Upgrade kernel-livepatch-5.15.186-128.192Upgrade kernel-toolsUpgrade kernel-tools-develUpgrade perfUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade python-perfUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade perfUpgrade kernel6.12-debuginfoUpgrade perf6.12Upgrade kernel-toolsUpgrade kernel-livepatch-6.1.144-170.251Upgrade kernel-libbpf-develUpgrade perf-debuginfoUpgrade python3-perfUpgrade python3-perf6.12-debuginfoUpgrade kernel-tools-develUpgrade kernel-modules-extra-commonUpgrade kernel-livepatch-6.12.35-55.103Upgrade kernel-headersUpgrade kernelUpgrade perf6.12-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade python3-perf6.12Upgrade bpftoolUpgrade kernel-libbpfUpgrade kernel6.12Upgrade kernel-develUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-libbpf-staticUpgrade kernel6.12-modules-extraUpgrade kernel-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-tools-debuginfo | Sep 9, 2025 | Jul 4, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jul 7, 2025 | Jul 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-perfUpgrade bpftoolUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-tools | Oct 14, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-libs | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel | Oct 24, 2025 | Oct 10, 2025 |
| Oracle_linux | — | Upgrade kernel-uek | Sep 10, 2025 | Jul 4, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 4, 2025 |
| Suse | — | Upgrade dtb-hisiliconUpgrade kernel-debug-develUpgrade kernel-rt-livepatch-develUpgrade kernel-macrosUpgrade dtb-amdUpgrade kernel-default-optionalUpgrade gfs2-kmp-rtUpgrade kernel-docsUpgrade kernel-default-extraUpgrade kernel-obs-qaUpgrade dtb-xilinxUpgrade reiserfs-kmp-rtUpgrade kernel-rtUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-rtUpgrade kernel-symsUpgrade reiserfs-kmp-azureUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-defaultUpgrade dtb-armUpgrade kernel-rt-livepatchUpgrade kernel-64kb-optionalUpgrade kernel-zfcpdumpUpgrade dtb-qcomUpgrade dtb-socionextUpgrade kernel-debugUpgrade kernel-syms-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-64kbUpgrade kernel-default-manUpgrade kernel-rt-develUpgrade dtb-apmUpgrade kernel-devel-rtUpgrade kernel-azure-develUpgrade kernel-devel-azureUpgrade dlm-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-64kbUpgrade kselftests-kmp-defaultUpgrade kselftests-kmp-rtUpgrade dtb-mediatekUpgrade kernel-64kb-develUpgrade kernel-kvmsmallUpgrade dtb-amlogicUpgrade kernel-syms-azureUpgrade kernel-rt_debugUpgrade gfs2-kmp-defaultUpgrade dtb-sprdUpgrade kernel-rt-vdsoUpgrade kernel-azure-extraUpgrade kernel-default-base-rebuildUpgrade dtb-alteraUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatchUpgrade ocfs2-kmp-64kbUpgrade kernel-source-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-extraUpgrade dtb-caviumUpgrade dtb-renesasUpgrade dtb-amazonUpgrade kernel-default-baseUpgrade gfs2-kmp-azureUpgrade dtb-marvellUpgrade cluster-md-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-vdsoUpgrade dtb-allwinnerUpgrade reiserfs-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-debug-vdsoUpgrade kernel-azureUpgrade dtb-rockchipUpgrade dtb-nvidiaUpgrade dtb-broadcomUpgrade dlm-kmp-64kbUpgrade kernel-obs-buildUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kernel-source-rtUpgrade kernel-default-develUpgrade ocfs2-kmp-azureUpgrade kernel-default-livepatch-develUpgrade dtb-lgUpgrade dtb-freescaleUpgrade kernel-develUpgrade kernel-azure-optionalUpgrade dlm-kmp-rtUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade dtb-exynosUpgrade kernel-sourceUpgrade ocfs2-kmp-defaultUpgrade kernel-default-vdsoUpgrade dtb-apple | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-34-generic-64kUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-gke-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-awsUpgrade linux-image-generic-6.14Upgrade linux-image-generic-64k-6.14Upgrade linux-image-azure-fipsUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-fipsUpgrade linux-image-gcp-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-raspi-6.8Upgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-raspiUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-aws-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-aws-64k-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-ibmUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-oem-22.04aUpgrade linux-image-ibm-6.8Upgrade linux-image-azureUpgrade linux-image-kvmUpgrade linux-image-gcp-64kUpgrade linux-image-aws-fipsUpgrade linux-image-generic-lpaeUpgrade linux-image-nvidia-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.14.0-34-genericUpgrade linux-image-aws-fips-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-xilinx-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-genericUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-intel-iotgUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-fips-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-xilinxUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-oracle-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-virtual-6.14Upgrade linux-image-virtualUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-gcpUpgrade linux-image-lowlatencyUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-gkeopUpgrade linux-image-realtimeUpgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-raspi-realtimeUpgrade linux-image-azure-6.8Upgrade linux-image-nvidiaUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-lowlatency-64k-6.8 | Jul 9, 2025 | Jul 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 16, 2025 | Jul 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub