Linux Kernel Framebuffer Subsystem Null Pointer Dereference Vulnerability

A null pointer dereference vulnerability has been identified in the Linux kernel's framebuffer (fbdev) subsystem. This issue arises in the 'fb_new_modelist' function, where the current video mode of a framebuffer ('info->var') is expected to have a corresponding entry in the mode list ('info->modelist'). The function 'var_to_display' relies on this consistency and treats any mismatch as an error. While 'fb_set_var' and 'do_register_framebuffer' correctly update the modelist, 'fb_new_modelist' fails to ensure that the current mode is still valid after a console takeover, particularly when 'fbcon' is unbound. This oversight can lead to a situation where 'var_to_display' receives a null mode, causing a dereference error.

Impact

Exploitation of this vulnerability leads to a null pointer dereference, causing a crash or undefined behavior in the framebuffer console.

Reproduction

The vulnerability can be reproduced by unbinding a framebuffer console and then triggering a console takeover, which will result in a null pointer dereference when the framebuffer's video mode is accessed.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.