CVE-2026-74424

What the bug is

fbcon_new_modelist() runs when a framebuffer's modelist changes. For each console mapped to it with fb_display[i].mode set, it reads vc_cons[i].d and passes the vc_num to fbcon_set_disp(). This assumes a console with a mode set has a vc_data, but it can be NULL. fbcon_set_disp() sets fb_display[i].mode before it checks vc_data, and fbcon_deinit() leaves the mode set after the vc_data is freed. fbcon_new_modelist() then dereferences the NULL vc_data. Keep fb_display[i].mode set only while the console has a vc_data. Check vc_data before setting the mode in fbcon_set_disp(), and clear the mode in fbcon_deinit(). The existing mode check in fbcon_new_modelist() then skips such consoles.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/video/fbdev/core/fbcon.c

What this is

FRAMEBUFFER CONSOLEMAINTAINERS section matched on drivers/video/fbdev/core/fbcon.c · dri-devel@lists.freedesktop.org · Maintained

Check it on the machine

grep -wE 'CONFIG_FB|CONFIG_FB_CORE|CONFIG_FRAMEBUFFER_CONSOLE' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

• bookwormy
• trixie, forky, sidYnot built on s390x/s390x

y

built into the kernel image on every flavour - only a patch removes it

Y

built in where it is built at all; some flavours do not build it

Build switches

CONFIG_FB, CONFIG_FB_CORE, CONFIG_FRAMEBUFFER_CONSOLE

Reads as

all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-08-15 (2 months ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.16%, higher than 4.9% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

drivers/video

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.23	5.15.212	8e9b8b008f40
2.6.23	6.1.178	cc4382dc5134
2.6.23	6.6.145	9b783b7e03dc
2.6.23	6.12.97	ac970358c5ca
2.6.23	6.18.40	6617df8c2463
2.6.23	7.1.5	b134ad2f7c06
2.6.23	7.2	5fae9a928482