Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Linux Linux — fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N U N N H 5.5 .0013 3.1 —
AFFECTED
Product Versions Fixed
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – —
Linux 2.6.12 – 5.10.260
TIMELINE
Jun 9 Reserved by Linux
Jul 19 Published (CNA: Linux)
Aug 17 ENRICHED — CVE-2026-53403 (Linux). Received CVSS 5.5 and CPE data from NVD.
Description
In the Linux kernel, the following vulnerability has been resolved:
fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
info->var, a framebuffer's current mode, is expected to have a matching
entry in info->modelist. var_to_display() relies on this and treats a
failed fb_match_mode() as "This should not happen". fb_set_var() keeps it
true by adding the mode to the list on every change, and
do_register_framebuffer() does the same at registration.
store_modes() replaces the modelist from userspace. fb_new_modelist()
validates the new modes but does not check that info->var still has a
match. It relies on fbcon_new_modelist() to re-point consoles, but that
only handles consoles mapped to the framebuffer. With fbcon unbound there
are none, so info->var is left describing a mode that is no longer in the
list.
A later console takeover runs var_to_display(), where fb_match_mode()
returns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it
to display_to_var(), and fb_videomode_to_var() dereferences the NULL mode.
Keep the current mode in the list in fb_new_modelist(), the same way
fb_set_var() does.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 9, 2026 | Reserved | Reserved by Linux |
| July 19, 2026 | Published | Published (CNA: Linux) |
| August 17, 2026 | ENRICHED | ENRICHED — CVE-2026-53403 (Linux). Received CVSS 5.5 and CPE data from NVD. |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Linux | Linux | — | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | — |
| Linux | Linux | — | 2.6.12 | 5.10.260 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-53403 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.