CVE-2026-53403 - Vulnerability Details

- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

Description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

info->var, a framebuffer's current mode, is expected to have a matching
entry in info->modelist. var_to_display() relies on this and treats a
failed fb_match_mode() as "This should not happen". fb_set_var() keeps it
true by adding the mode to the list on every change, and
do_register_framebuffer() does the same at registration.

store_modes() replaces the modelist from userspace. fb_new_modelist()
validates the new modes but does not check that info->var still has a
match. It relies on fbcon_new_modelist() to re-point consoles, but that
only handles consoles mapped to the framebuffer. With fbcon unbound there
are none, so info->var is left describing a mode that is no longer in the
list.

A later console takeover runs var_to_display(), where fb_match_mode()
returns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it
to display_to_var(), and fb_videomode_to_var() dereferences the NULL mode.

Keep the current mode in the list in fb_new_modelist(), the same way
fb_set_var() does.

Published: 2026-07-19

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a null pointer dereference that can occur in the Linux kernel’s framebuffer subsystem when a userspace process updates the framebuffer modelist. If the current mode reference is lost, a later console switch may dereference a NULL mode object, potentially causing a kernel panic or system crash. The CWE associated is CWE‑476. The impact is a denial of service that requires local or privileged execution to trigger.

Affected Systems

The affected product is the Linux kernel. All kernel releases that include the buggy fb_new_modelist logic and have not applied the patch are vulnerable. The defect was fixed in commit 0d8c7f21ad8529d5c181e61f86be35b887ae2e4d, which is incorporated in mainstream kernels released after that commit.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% implies a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, and there is no publicly documented exploit. The attack vector is most likely local, requiring a user with the ability to execute framebuffer operations, or local privilege escalation to a process that can manipulate fbdev modes. Patch availability makes the risk manageable.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1458a4d804550b7101e8bb02c1cb941088e4c0c7
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 8707f02ac9f5f632039b60df2c9f3dc914709f72
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 0d8c7f21ad8529d5c181e61f86be35b887ae2e4d
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 7640b4f68acb54c2c4f6b4a8aee0e9849dacd929
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4f1a7fe8ba845cb7d39580755f78c3b7b9a0b61e
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< eea16b6f805c0b1fb2f72f0f771088ea45356956
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 88913059c77e171f44ba829282d42dde0d458811
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 7f08fc10fa3d3366dc3af723970bd03d7d6d10e3

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.260`	unaffected	≤ 5.10.*
`5.15.211`	unaffected	≤ 5.15.*
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.38`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1458a4d804550b7101e8bb02c1cb941088e4c0c7)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8707f02ac9f5f632039b60df2c9f3dc914709f72)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0d8c7f21ad8529d5c181e61f86be35b887ae2e4d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7640b4f68acb54c2c4f6b4a8aee0e9849dacd929)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4f1a7fe8ba845cb7d39580755f78c3b7b9a0b61e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,eea16b6f805c0b1fb2f72f0f771088ea45356956)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,88913059c77e171f44ba829282d42dde0d458811)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7f08fc10fa3d3366dc3af723970bd03d7d6d10e3)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.10.260,5.10.*]`	unaffected	generic	—
`[5.15.211,5.15.*]`	unaffected	generic	—
`[6.1.177,6.1.*]`	unaffected	generic	—
`[6.6.144,6.6.*]`	unaffected	generic	—
`[6.12.95,6.12.*]`	unaffected	generic	—
`[6.18.38,6.18.*]`	unaffected	generic	—
`[7.1.3,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that contains commit 0d8c7f21ad8529d5c181e61f86be35b887ae2e4d.
If immediate kernel update is not possible, restrict access to framebuffer devices by removing write permissions from untrusted users and disabling the fbcon console module for non‑privileged sessions.
Monitor for framebuffer panics or unexpected console switches, and apply the kernel patch as soon as it becomes available.

Generated by OpenCVE AI on July 30, 2026 at 22:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4700-1	linux-6.1 security update
Debian DLA	DLA-4717-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0d8c7f21ad8529d5c181e61f86be35b887ae2e4d
https://git.kernel.org/stable/c/1458a4d804550b7101e8bb02c1cb941088e4c0c7
https://git.kernel.org/stable/c/4f1a7fe8ba845cb7d39580755f78c3b7b9a0b61e
https://git.kernel.org/stable/c/7640b4f68acb54c2c4f6b4a8aee0e9849dacd929
https://git.kernel.org/stable/c/7f08fc10fa3d3366dc3af723970bd03d7d6d10e3
https://git.kernel.org/stable/c/8707f02ac9f5f632039b60df2c9f3dc914709f72
https://git.kernel.org/stable/c/88913059c77e171f44ba829282d42dde0d458811
https://git.kernel.org/stable/c/eea16b6f805c0b1fb2f72f0f771088ea45356956
https://lore.kernel.org/linux-cve-announce/2026071959-CVE-2026-53403-6dc1@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53403
https://www.cve.org/CVERecord?id=CVE-2026-53403

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026071959-CVE-2026-53403-6dc1@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53403 https://www.cve.org/CVERecord?id=CVE-2026-53403
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var info->var, a framebuffer's current mode, is expected to have a matching entry in info->modelist. var_to_display() relies on this and treats a failed fb_match_mode() as "This should not happen". fb_set_var() keeps it true by adding the mode to the list on every change, and do_register_framebuffer() does the same at registration. store_modes() replaces the modelist from userspace. fb_new_modelist() validates the new modes but does not check that info->var still has a match. It relies on fbcon_new_modelist() to re-point consoles, but that only handles consoles mapped to the framebuffer. With fbcon unbound there are none, so info->var is left describing a mode that is no longer in the list. A later console takeover runs var_to_display(), where fb_match_mode() returns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it to display_to_var(), and fb_videomode_to_var() dereferences the NULL mode. Keep the current mode in the list in fb_new_modelist(), the same way fb_set_var() does.
Title		fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0d8c7f21ad8529d5c181e61f86be35b887ae2e4d https://git.kernel.org/stable/c/1458a4d804550b7101e8bb02c1cb941088e4c0c7 https://git.kernel.org/stable/c/4f1a7fe8ba845cb7d39580755f78c3b7b9a0b61e https://git.kernel.org/stable/c/7640b4f68acb54c2c4f6b4a8aee0e9849dacd929 https://git.kernel.org/stable/c/7f08fc10fa3d3366dc3af723970bd03d7d6d10e3 https://git.kernel.org/stable/c/8707f02ac9f5f632039b60df2c9f3dc914709f72 https://git.kernel.org/stable/c/88913059c77e171f44ba829282d42dde0d458811 https://git.kernel.org/stable/c/eea16b6f805c0b1fb2f72f0f771088ea45356956

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:02:02.382Z

Updated: 2026-07-20T06:41:25.020Z

Reserved: 2026-06-09T07:44:35.403Z

Link: CVE-2026-53403

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Low

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-53403 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T22:30:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object