CVE-2026-53403

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

info->var, a framebuffer's current mode, is expected to have a matching

entry in info->modelist. var_to_display() relies on this and treats a

failed fb_match_mode() as "This should not happen". fb_set_var() keeps it

true by adding the mode to the list on every change, and

do_register_framebuffer() does the same at registration.

store_modes() replaces the modelist from userspace. fb_new_modelist()

validates the new modes but does not check that info->var still has a

match. It relies on fbcon_new_modelist() to re-point consoles, but that

only handles consoles mapped to the framebuffer. With fbcon unbound there

are none, so info->var is left describing a mode that is no longer in the

list.

A later console takeover runs var_to_display(), where fb_match_mode()

returns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it

to display_t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References