CVE-2026-74320fbdev: sm501fb: Fix buffer errors in OF binding code
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks. info->edid_data isn't free if the probe functions fail or if pd->def_mode is set. If both the CRT and PANEL are enabled info->edid_data is used after being freed and is freed twice. The string returned by of_get_property(np, "mode", &len) is just written over either the static "640x480-16@60" or the module parameter string without any regard for the length (which is most likely longer). Use kstrump() for the OF mode and free everything before freeing 'info.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 4295f9bf74a885da390abc49a3b42a011c1bb890 builds before 0bc3d909a49e1fd8b8c3f2160d526e672c40621d; from 4295f9bf74a885da390abc49a3b42a011c1bb890 before 47008d59c60ed896085da95f8d4dd40e1677dd3a; from 4295f9bf74a885da390abc49a3b42a011c1bb890 before d374f76e1257ecc5d691a765c512ed2c29a44741; from 4295f9bf74a885da390abc49a3b42a011c1bb890 before b2ff450f7f5cfc7143cab57c3ad70293ba8b822a; from 4295f9bf74a885da390abc49a3b42a011c1bb890 before 9057e3f5db39f0ef0dac2f59f2bc59bf17e36c31; from 4295f9bf74a885da390abc49a3b42a011c1bb890 before de590cdf7efec8a0b6da90ae2ab5fc5df26810b9; 4295f9bf74a885da390abc49a3b42a011c1bb890 builds before 48cf0f4c6581ec90104cec9c5bf794a8bf347e30; from 4295f9bf74a885da390abc49a3b42a011c1bb890 before d8421e09382cfe0bd2a044c8b0a822f64855dd4e | CNA record |
References
- https://git.kernel.org/stable/c/0bc3d909a49e1fd8b8c3f2160d526e672c40621d
- https://git.kernel.org/stable/c/47008d59c60ed896085da95f8d4dd40e1677dd3a
- https://git.kernel.org/stable/c/d374f76e1257ecc5d691a765c512ed2c29a44741
- https://git.kernel.org/stable/c/b2ff450f7f5cfc7143cab57c3ad70293ba8b822a
- https://git.kernel.org/stable/c/9057e3f5db39f0ef0dac2f59f2bc59bf17e36c31
- https://git.kernel.org/stable/c/de590cdf7efec8a0b6da90ae2ab5fc5df26810b9
- https://git.kernel.org/stable/c/48cf0f4c6581ec90104cec9c5bf794a8bf347e30
- https://git.kernel.org/stable/c/d8421e09382cfe0bd2a044c8b0a822f64855dd4e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.