CVE-2026-74320
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
fbdev: sm501fb: Fix buffer errors in OF binding code
In the Linux kernel, the following vulnerability has been resolved: fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks. info->edid_data isn't free if the probe functions fail or if pd->def_mode is set. If both the CRT and PANEL are enabled info->edid_data is used after being freed and is freed twice. The string returned by of_get_property(np, "mode", &len) is just written over either the static "640x480-16@60" or the module parameter string without any regard for the length (which is most likely longer). Use kstrump() for the OF mode and free everything before freeing 'info.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 4295f9bf74a885da390abc49a3b42a011c1bb890 | affected | git | 0bc3d909a49e1fd8b8c3f2160d526e672c40621d | Unavailable | None listed |
| 4295f9bf74a885da390abc49a3b42a011c1bb890 | affected | git | 47008d59c60ed896085da95f8d4dd40e1677dd3a | Unavailable | None listed |
| 4295f9bf74a885da390abc49a3b42a011c1bb890 | affected | git | d374f76e1257ecc5d691a765c512ed2c29a44741 | Unavailable | None listed |
| 4295f9bf74a885da390abc49a3b42a011c1bb890 | affected | git | b2ff450f7f5cfc7143cab57c3ad70293ba8b822a | Unavailable | None listed |
| 4295f9bf74a885da390abc49a3b42a011c1bb890 | affected | git | 9057e3f5db39f0ef0dac2f59f2bc59bf17e36c31 | Unavailable | None listed |
| 4295f9bf74a885da390abc49a3b42a011c1bb890 | affected | git | de590cdf7efec8a0b6da90ae2ab5fc5df26810b9 | Unavailable | None listed |
| 4295f9bf74a885da390abc49a3b42a011c1bb890 | affected | git | 48cf0f4c6581ec90104cec9c5bf794a8bf347e30 | Unavailable | None listed |
| 4295f9bf74a885da390abc49a3b42a011c1bb890 | affected | git | d8421e09382cfe0bd2a044c8b0a822f64855dd4e | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.6.39 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 2.6.39 | Unavailable | None listed |
| 5.10.261 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.212 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.178 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.145 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.97 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.40 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.1.5 | unaffected | semver | Unavailable | 7.1.* | None listed |
| 7.2 | unaffected | original_commit_for_fix | Unavailable | * | None listed |