« Volver al listado

CVE-2026-74320

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

fbdev: sm501fb: Fix buffer errors in OF binding code

The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks.

info->edid_data isn't free if the probe functions fail or if pd->def_mode is set.

If both the CRT and PANEL are enabled info->edid_data is used after being freed and is freed twice.

The string returned by of_get_property(np, "mode", &len) is just written over either the static "640x480-16@60" or the module parameter string without any regard for the length (which is most likely longer).

Leer descripción completaMostrar menos

Use kstrump() for the OF mode and free everything before freeing 'info.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-74320",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
              "lessThan": "0bc3d909a49e1fd8b8c3f2160d526e672c40621d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
              "lessThan": "47008d59c60ed896085da95f8d4dd40e1677dd3a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
              "lessThan": "d374f76e1257ecc5d691a765c512ed2c29a44741",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
              "lessThan": "b2ff450f7f5cfc7143cab57c3ad70293ba8b822a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
              "lessThan": "9057e3f5db39f0ef0dac2f59f2bc59bf17e36c31",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
              "lessThan": "de590cdf7efec8a0b6da90ae2ab5fc5df26810b9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
              "lessThan": "48cf0f4c6581ec90104cec9c5bf794a8bf347e30",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
              "lessThan": "d8421e09382cfe0bd2a044c8b0a822f64855dd4e",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/video/fbdev/sm501fb.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.39",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/video/fbdev/sm501fb.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:22:32.457",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0bc3d909a49e1fd8b8c3f2160d526e672c40621d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/47008d59c60ed896085da95f8d4dd40e1677dd3a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/48cf0f4c6581ec90104cec9c5bf794a8bf347e30",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9057e3f5db39f0ef0dac2f59f2bc59bf17e36c31",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b2ff450f7f5cfc7143cab57c3ad70293ba8b822a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d374f76e1257ecc5d691a765c512ed2c29a44741",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d8421e09382cfe0bd2a044c8b0a822f64855dd4e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/de590cdf7efec8a0b6da90ae2ab5fc5df26810b9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: sm501fb: Fix buffer errors in OF binding code\n\nThe code that gets the frame buffer mode from OF has 'use after free',\n'buffer overrun' and memory leaks.\n\ninfo->edid_data isn't free if the probe functions fail or if\npd->def_mode is set.\n\nIf both the CRT and PANEL are enabled info->edid_data is used after\nbeing freed and is freed twice.\n\nThe string returned by of_get_property(np, \"mode\", &len) is just\nwritten over either the static \"640x480-16@60\" or the module parameter\nstring without any regard for the length (which is most likely longer).\n\nUse kstrump() for the OF mode and free everything before freeing 'info."
    }
  ],
  "lastModified": "2026-08-17T06:19:26.403",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}