PT-2026-44332

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11-1.1 Description An inconsistency exists in the calculation of sub-sampled plane dimensions within the drm gem fb init with funcs function. While the framebuffer check function uses DIV ROUND UP to round up...

Siemens SIMATIC S7-1500 NULL Pointer Dereference(CVE-2025-38214)

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fbsetvar to prevent null-ptr-deref in fbvideomodetovar If fbaddvideomode in fbsetvar fails to allocate memory for fbvideomode, later it may lead to a null-ptr dereference in fbvideomodetovar, as the fbinfo is registere...

EUVD-2026-13990

The Simple Football Scoreboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ytmrfbscoreboard' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2026-23051

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix drm panic null pointer when driver not support atomic When driver not support atomic, fb using plane-fb rather than plane-state-fb. cherry picked from commit 2f2a72de673513247cd6fae14e53f6c40c5841ef...

CVE-2026-23051

CVE-2026-23051 is a Linux kernel fix for drm/amdgpu where a null-pointer panic could occur when the driver does not support atomic. The mitigation changes fb handling to use plane->fb instead of plane->state->fb in non-atomic paths. This was addressed by cherry‑picking a commit (2f2a72de...

CVE-2026-23051 drm/amdgpu: fix drm panic null pointer when driver not support atomic

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix drm panic null pointer when driver not support atomic When driver not support atomic, fb using plane-fb rather than plane-state-fb. cherry picked from commit 2f2a72de673513247cd6fae14e53f6c40c5841ef...

CVE-2026-23051

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix drm panic null pointer when driver not support atomic When driver not support atomic, fb using plane-fb rather than plane-state-fb. cherry picked from commit 2f2a72de673513247cd6fae14e53f6c40c5841ef...

UBUNTU-CVE-2026-23039

In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix NULL fb and crtc dereferences on USB disconnect On disconnect drmatomichelperdisableall is called which sets both the fb and crtc for a plane to NULL before invoking a commit. This causes a kernel oops on every displ...

CVE-2026-23039 drm/gud: fix NULL fb and crtc dereferences on USB disconnect

In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix NULL fb and crtc dereferences on USB disconnect On disconnect drmatomichelperdisableall is called which sets both the fb and crtc for a plane to NULL before invoking a commit. This causes a kernel oops on every displ...

CVE-2026-23039

In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix NULL fb and crtc dereferences on USB disconnect On disconnect drmatomichelperdisableall is called which sets both the fb and crtc for a plane to NULL before invoking a commit. This causes a kernel oops on every displ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005105)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005105 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds read of dfv17channelnumber Check the fbchannelnumber range to avoid...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001795)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001795 advisory. Integer overflow in the fbmmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other...

CVE-2022-35911

On Patlite NH-FB series devices through 1.46, remote attackers can cause a denial of service by omitting the query string. NOTE: the vendor's perspective is that "omitting the query string does not cause a denial of service and the indicated event can not be reproduced...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-992621)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992621 advisory. In the Linux kernel, the following vulnerability has been resolved: fbdev/ep93xx-fb: Do not assign to struct fbinfo.dev Do not assing the Linux device to struct...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992649)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992649 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds read of dfv17channelnumber Check the fbchannelnumber range to avoid...

fbcon: Set fb_display[i]->mode to NULL when the mode is released

...

CVE-2025-40323

No description is available for this CVE. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria, comprising ease of use and deployment, applicability to widespread installation base or stability...

CVE-2025-40323

In the Linux kernel, the following vulnerability has been resolved: fbcon: Set fbdisplayi-mode to NULL when the mode is released Recently, we discovered the following issue through syzkaller: BUG: KASAN: slab-use-after-free in fbmodeisequal+0x285/0x2f0 Read of size 4 at addr ff11000001b3c69c by...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from not setting fbdisplayi-mode to NULL, which could lead to reuse after release...

CVE-2025-40256: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xfrm: also call xfrmstatedeletetunnel at destroy time for states that were never added In commit b441cf3f8c4b "xfrm: delete x-tunnel as we delete x", I missed the case where state creation fails between full initialization...