In the Linux kernel, the following vulnerability has been resolved:
fbcon: fix NULL pointer dereference for a console without vc_data
fbconnewmodelist() runs when a framebuffer's modelist changes. For each console mapped to it with fbdisplay[i].mode set, it reads vccons[i].d and passes the vcnum to fbconsetdisp(). This assumes a console with a mode set has a vcdata, but it can be NULL. fbconsetdisp() sets fbdisplay[i].mode before it checks vcdata, and fbcondeinit() leaves the mode set after the vcdata is freed. fbconnewmodelist() then dereferences the NULL vc_data.
Keep fbdisplay[i].mode set only while the console has a vcdata. Check vcdata before setting the mode in fbconsetdisp(), and clear the mode in fbcondeinit(). The existing mode check in fbconnewmodelist() then skips such consoles.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74424.json",
"cna_assigner": "Linux"
}