Executive brief
A vulnerability was identified in the Linux kernel's framebuffer device (fbdev) subsystem, which manages how video hardware displays graphics. A local user could trigger a system crash (kernel panic) by updating display modes under specific conditions where the system console is not actively bound to the display. This issue primarily impacts system availability, potentially leading to a denial-of-service on affected Linux machines.
Technical details
A null pointer dereference exists in the Linux kernel's fbdev subsystem within the `fb_videomode_to_var` function. The issue occurs because `fb_new_modelist` replaces the modelist from userspace without verifying that the current mode (`info->var`) still has a matching entry in the new list. If the framebuffer console (`fbcon`) is unbound during this update, `fbcon_new_modelist` fails to re-point the console, leaving `info->var` orphaned. A subsequent console takeover triggers `var_to_display()`, which returns a NULL mode that is eventually dereferenced by `fb_videomode_to_var`. The fix ensures the current mode is preserved in the modelist during updates.
Affected products
- Linux Linux Kernel All versions prior to fixed stable releases (6.1, 6.6, 6.9, 6.10, etc.)
Timeline
- 2026-06-24: disclosed: Vulnerability reported and patch authored by Ian Bridges.
- 2026-07-04: patched: Patch committed to Linux stable tree.
- 2026-07-19: advisory: CVE-2026-53403 published.
References
- https://git.kernel.org/stable/c/0d8c7f21ad8529d5c181e61f86be35b887ae2e4d
- https://git.kernel.org/stable/c/1458a4d804550b7101e8bb02c1cb941088e4c0c7
- https://git.kernel.org/stable/c/4f1a7fe8ba845cb7d39580755f78c3b7b9a0b61e
- https://git.kernel.org/stable/c/7640b4f68acb54c2c4f6b4a8aee0e9849dacd929
- https://git.kernel.org/stable/c/7f08fc10fa3d3366dc3af723970bd03d7d6d10e3
- https://git.kernel.org/stable/c/8707f02ac9f5f632039b60df2c9f3dc914709f72
- https://git.kernel.org/stable/c/88913059c77e171f44ba829282d42dde0d458811