{"cve":"CVE-2026-74424","nvd":{"published":"2026-08-15T06:22:44.480","modified":"2026-08-18T07:16:54.610","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: fix NULL pointer dereference for a console without vc_data\n\nfbcon_new_modelist() runs when a framebuffer's modelist changes. For each\nconsole mapped to it with fb_display[i].mode set, it reads vc_cons[i].d and\npasses the vc_num to fbcon_set_disp(). This assumes a console with a mode\nset has a vc_data, but it can be NULL. fbcon_set_disp() sets\nfb_display[i].mode before it checks vc_data, and fbcon_deinit() leaves the\nmode set after the vc_data is freed. fbcon_new_modelist() then dereferences\nthe NULL vc_data.\n\nKeep fb_display[i].mode set only while the console has a vc_data. Check\nvc_data before setting the mode in fbcon_set_disp(), and clear the mode in\nfbcon_deinit(). The existing mode check in fbcon_new_modelist() then skips\nsuch consoles.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/5fae9a928482d4845bca169a3a098789203a1ca4","https://git.kernel.org/stable/c/6617df8c246311c82cebf061a4cee55b9df60922","https://git.kernel.org/stable/c/8e9b8b008f4036df0318870c5d754134ff1b94cc","https://git.kernel.org/stable/c/9b783b7e03dc78ec102edf618259a2b55911fc6a","https://git.kernel.org/stable/c/ac970358c5ca0775841bd2a56ce15dc464b99003"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:49:10.689564601+00:00"},"epss":{"cve":"CVE-2026-74424","score":0.00161,"percentile":0.05302,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}