CVE-2026-74424: Linux kernel · fbcon: fix NULL pointer dereference for a console without vc_data
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in cc4382dc5134826a3936a6b08de17f7dc7abe232 : update Linux kernel when convenient.
Data as of 6 Nov 2026, 18:03 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-06.
- Patch
- Available – fixed in cc4382dc5134826a3936a6b08de17f7dc7abe232, b134ad2f7c06b3c1098dcc95008e2045ff4b49b2, ac970358c5ca0775841bd2a56ce15dc464b99003 +4
Exploitation evidence
Disclosed: evidence found.
CVE published 15 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available in the Linux kernel as indicated by the presence of fixed versions (commit hashes). Users should update to a kernel version that includes these fixes to prevent the NULL pointer dereference. No additional mitigation steps are indicated or required beyond applying the official patch.
Description
A NULL pointer dereference vulnerability in the Linux kernel framebuffer console (fbcon) subsystem was fixed. The issue occurs when fbcon_new_modelist() dereferences a NULL vc_data pointer for a console without valid vc_data, leading to potential kernel crashes. The fix ensures fb_display[i].mode is only set when vc_data is valid and clears the mode appropriately to prevent dereferencing NULL pointers.
References
- git.kernel.org/stable/c/8e9b8b008f4036df0318870c5d754134ff1b94cc (opens in a new tab)
- git.kernel.org/stable/c/cc4382dc5134826a3936a6b08de17f7dc7abe232 (opens in a new tab)
- git.kernel.org/stable/c/9b783b7e03dc78ec102edf618259a2b55911fc6a (opens in a new tab)
- git.kernel.org/stable/c/ac970358c5ca0775841bd2a56ce15dc464b99003 (opens in a new tab)
- git.kernel.org/stable/c/6617df8c246311c82cebf061a4cee55b9df60922 (opens in a new tab)
- git.kernel.org/stable/c/b134ad2f7c06b3c1098dcc95008e2045ff4b49b2 (opens in a new tab)
- git.kernel.org/stable/c/5fae9a928482d4845bca169a3a098789203a1ca4 (opens in a new tab)