CVE-2026-43123

fbcon: check return value of con2fb_acquire_newinfo()

Published May 6, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

fbcon: check return value of con2fb_acquire_newinfo()

If fbcon_open() fails when called from con2fb_acquire_newinfo() then
info->fbcon_par pointer remains NULL which is later dereferenced.

Add check for return value of the function con2fb_acquire_newinfo() to
avoid it.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Analysis

Technical impact

In the Linux kernel framebuffer console (fbcon) subsystem, the function fbcon_open() can call con2fb_acquire_newinfo() and, if that function fails, the returned pointer remains null. Subsequent dereferencing of this NULL pointer causes a kernel panic. The flaw results in a denial of service that forces the kernel to halt or reboot, affecting availability but not confidentiality or integrity. It exemplifies the weaknesses CWE-252 (Missing Return Value Check) and CWE-476 (Null Pointer Dereference). The likely attack vector is local console or framebuffer operations, inferred from the description.

Affected Systems

The CVE record does not specify any affected kernel version range; therefore it is unknown which releases contain the vulnerable code path. Administrators should verify whether their running kernel includes the fbcon code branch that was patched in the commit referenced in the CVE. All kernels built from source that include the pre‑patch fbcon implementation could potentially be affected, but no exact version data is provided.

Risk and Exploitability

The CVSS score is 5.5 and the EPSS score is less than 1%, indicating a moderate severity but a low likelihood of exploitation. The flaw can only be triggered locally by an attacker able to perform console or framebuffer operations, such as opening /dev/fb* or forcing a console switch. Based on the description, the likely attack vector is local. Because the vulnerability is not listed in the CISA KEV catalog, immediate widespread exploitation is not expected, yet the kernel crash impact warrants timely remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e`	affected	< d3e535533767c85788529e626478718b7e95a59f
`d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e`	affected	< 3b5a754ec86bc6064af9aca76eb191c2405e6b0c
`d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e`	affected	< a785c4e2a999c2d51dfcf40d317cfb30cc735d2c
`d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e`	affected	< 0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc
`d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e`	affected	< 11a93180a70bb3095a9bd80d113d9277e30d9959
`d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e`	affected	< f57b61624c86ef8f87f6e6b7dd0755de03d90e89
`d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e`	affected	< 011a0502801c8536f64141a2b61362c14f456544

Linux

affected

Version	Status	Constraints
`2.6.23`	affected	—
`0`	unaffected	< 2.6.23
`5.15.203`	unaffected	≤ 5.15.*
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.16`	unaffected	≤ 6.18.*
`6.19.6`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e,d3e535533767c85788529e626478718b7e95a59f)`	affected	code_commit	—
`[d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e,3b5a754ec86bc6064af9aca76eb191c2405e6b0c)`	affected	code_commit	—
`[d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e,a785c4e2a999c2d51dfcf40d317cfb30cc735d2c)`	affected	code_commit	—
`[d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e,0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc)`	affected	code_commit	—
`[d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e,11a93180a70bb3095a9bd80d113d9277e30d9959)`	affected	code_commit	—
`[d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e,f57b61624c86ef8f87f6e6b7dd0755de03d90e89)`	affected	code_commit	—
`[d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e,011a0502801c8536f64141a2b61362c14f456544)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`2.6.23`	affected	semver	—
`[0,2.6.23)`	unaffected	semver	—
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.165,6.2.0)`	unaffected	semver	—
`[6.6.128,6.7.0)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.16,6.19.0)`	unaffected	semver	—
`[6.19.6,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install a Linux kernel update that contains the check for the return value of con2fb_acquire_newinfo()
Restrict access to framebuffer devices (/dev/fb*) so that only privileged users can open them, minimizing exposure of the flaw
Enable kernel crash logging and regularly monitor system logs for fbcon‑related panics, applying the patch as soon as a panic is detected

Generated by OpenCVE AI on May 13, 2026 at 00:36 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8492-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8492-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8497-1	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-8498-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8492-3	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8492-4	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8492-5	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.128% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/011a0502801c8536f64141a2b61362c14f456544
https://git.kernel.org/stable/c/0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc
https://git.kernel.org/stable/c/11a93180a70bb3095a9bd80d113d9277e30d9959
https://git.kernel.org/stable/c/3b5a754ec86bc6064af9aca76eb191c2405e6b0c
https://git.kernel.org/stable/c/a785c4e2a999c2d51dfcf40d317cfb30cc735d2c
https://git.kernel.org/stable/c/d3e535533767c85788529e626478718b7e95a59f
https://git.kernel.org/stable/c/f57b61624c86ef8f87f6e6b7dd0755de03d90e89
https://lore.kernel.org/linux-cve-announce/2026050618-CVE-2026-43123-1166@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43123
https://www.cve.org/CVERecord?id=CVE-2026-43123

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 12, 2026 9:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476

May 7, 2026 3:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-476

May 7, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-252
References		https://lore.kernel.org/linux-cve-announce/2026050618-CVE-2026-43123-1166@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43123 https://www.cve.org/CVERecord?id=CVE-2026-43123
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

May 6, 2026 1:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476

May 6, 2026 12:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fbcon: check return value of con2fb_acquire_newinfo() If fbcon_open() fails when called from con2fb_acquire_newinfo() then info->fbcon_par pointer remains NULL which is later dereferenced. Add check for return value of the function con2fb_acquire_newinfo() to avoid it. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Title		fbcon: check return value of con2fb_acquire_newinfo()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/011a0502801c8536f64141a2b61362c14f456544 https://git.kernel.org/stable/c/0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc https://git.kernel.org/stable/c/11a93180a70bb3095a9bd80d113d9277e30d9959 https://git.kernel.org/stable/c/3b5a754ec86bc6064af9aca76eb191c2405e6b0c https://git.kernel.org/stable/c/a785c4e2a999c2d51dfcf40d317cfb30cc735d2c https://git.kernel.org/stable/c/d3e535533767c85788529e626478718b7e95a59f https://git.kernel.org/stable/c/f57b61624c86ef8f87f6e6b7dd0755de03d90e89