{"apiVersion":"1.0","identifier":"CVE-2026-74424","description":"In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vc_data fbcon_new_modelist() runs when a framebuffer-s modelist changes. For each console mapped to it with fb_display[i].mode set, it reads vc_cons[i].d and passes the vc_num to fbcon_set_disp(). This assumes a console with a mode set has a vc_data, but it can be NULL. fbcon_set_disp() sets fb_display[i].mode before it checks vc_data, and fbcon_deinit() leaves the mode set after the vc_data is freed. fbcon_new_modelist() then dereferences the NULL vc_data. Keep fb_display[i].mode set only while the console has a vc_data. Check vc_data before setting the mode in fbcon_set_disp(), and clear the mode in fbcon_deinit(). The existing mode check in fbcon_new_modelist() then skips such consoles.","publishedAt":"2026-08-15T06:22:44","lastModifiedAt":"2026-08-18T07:16:54","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74424","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00161,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74424","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74424","en":"https://www.redsauce.net/en/cves/CVE-2026-74424","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74424","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74424","de":"https://www.redsauce.net/de/cves/CVE-2026-74424","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74424","el":"https://www.redsauce.net/el/cves/CVE-2026-74424"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74424"}}