CVE-2026-53403

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var<br /> <br /> info-&gt;var, a framebuffer&amp;#39;s current mode, is expected to have a matching<br /> entry in info-&gt;modelist. var_to_display() relies on this and treats a<br /> failed fb_match_mode() as "This should not happen". fb_set_var() keeps it<br /> true by adding the mode to the list on every change, and<br /> do_register_framebuffer() does the same at registration.<br /> <br /> store_modes() replaces the modelist from userspace. fb_new_modelist()<br /> validates the new modes but does not check that info-&gt;var still has a<br /> match. It relies on fbcon_new_modelist() to re-point consoles, but that<br /> only handles consoles mapped to the framebuffer. With fbcon unbound there<br /> are none, so info-&gt;var is left describing a mode that is no longer in the<br /> list.<br /> <br /> A later console takeover runs var_to_display(), where fb_match_mode()<br /> returns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it<br /> to display_to_var(), and fb_videomode_to_var() dereferences the NULL mode.<br /> <br /> Keep the current mode in the list in fb_new_modelist(), the same way<br /> fb_set_var() does.