CVE-2026-74320
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks. info->edid_data isn't free if the probe functions fail or if pd->def_mode is set. If both the CRT and PANEL are enabled info->edid_data is used after being freed and is freed twice. The string returned by of_get_property(np, "mode", &len) is just written over either the static "640x480-16@60" or the module parameter string without any regard for the length (which is most likely longer). Use kstrump() for the OF mode and free everything before freeing 'info.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-08-15 06:22:32.457000
Last modified
2026-11-06 17:19:45.830000
View original CVE JSON
{
"id": "CVE-2026-74320",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-08-15T06:22:32.457",
"lastModified": "2026-11-06T17:19:45.830",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: sm501fb: Fix buffer errors in OF binding code\n\nThe code that gets the frame buffer mode from OF has 'use after free',\n'buffer overrun' and memory leaks.\n\ninfo->edid_data isn't free if the probe functions fail or if\npd->def_mode is set.\n\nIf both the CRT and PANEL are enabled info->edid_data is used after\nbeing freed and is freed twice.\n\nThe string returned by of_get_property(np, \"mode\", &len) is just\nwritten over either the static \"640x480-16@60\" or the module parameter\nstring without any regard for the length (which is most likely longer).\n\nUse kstrump() for the OF mode and free everything before freeing 'info."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/video/fbdev/sm501fb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
"lessThan": "0bc3d909a49e1fd8b8c3f2160d526e672c40621d",
"versionType": "git",
"status": "affected"
},
{
"version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
"lessThan": "47008d59c60ed896085da95f8d4dd40e1677dd3a",
"versionType": "git",
"status": "affected"
},
{
"version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
"lessThan": "d374f76e1257ecc5d691a765c512ed2c29a44741",
"versionType": "git",
"status": "affected"
},
{
"version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
"lessThan": "b2ff450f7f5cfc7143cab57c3ad70293ba8b822a",
"versionType": "git",
"status": "affected"
},
{
"version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
"lessThan": "9057e3f5db39f0ef0dac2f59f2bc59bf17e36c31",
"versionType": "git",
"status": "affected"
},
{
"version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
"lessThan": "de590cdf7efec8a0b6da90ae2ab5fc5df26810b9",
"versionType": "git",
"status": "affected"
},
{
"version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
"lessThan": "48cf0f4c6581ec90104cec9c5bf794a8bf347e30",
"versionType": "git",
"status": "affected"
},
{
"version": "4295f9bf74a885da390abc49a3b42a011c1bb890",
"lessThan": "d8421e09382cfe0bd2a044c8b0a822f64855dd4e",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/video/fbdev/sm501fb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "2.6.39",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.39",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.261",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.212",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.178",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.145",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.97",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.40",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.5",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-06T16:56:00.818973Z",
"id": "CVE-2026-74320",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0bc3d909a49e1fd8b8c3f2160d526e672c40621d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/47008d59c60ed896085da95f8d4dd40e1677dd3a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/48cf0f4c6581ec90104cec9c5bf794a8bf347e30",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9057e3f5db39f0ef0dac2f59f2bc59bf17e36c31",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b2ff450f7f5cfc7143cab57c3ad70293ba8b822a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d374f76e1257ecc5d691a765c512ed2c29a44741",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d8421e09382cfe0bd2a044c8b0a822f64855dd4e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/de590cdf7efec8a0b6da90ae2ab5fc5df26810b9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}