CVE-2026-74320

A flaw was found in the fbdev: sm501fb component of the Linux kernel. The code responsible for obtaining frame buffer mode information from Open Firmware (OF) binding contains multiple memory handling errors. These include use-after-free vulnerabilities, buffer overruns when writing mode strings without proper length checks, and memory leaks. These issues could lead to system instability or potentially allow a local attacker to impact system integrity.

A moderate-impact flaw was found in the Linux kernel fbdev sm501fb driver, in the Open Firmware (OF) binding code that obtains the frame buffer mode. The mode string returned by of_get_property() is written over either the static "640x480-16@60" default or the module parameter string without regard to its length, causing a buffer overrun; when both the CRT and PANEL outputs are enabled, info->edid_data is used after being freed and is freed twice; and the same buffer leaks when the probe functions fail or a platform default mode is set. Exploitation requires local access, and these memory-handling errors could lead to system instability or potentially allow a local attacker to impact system integrity. Red Hat rates the impact as Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), with availability being the primary consequence. All Red Hat products currently in scope for this flaw — Red Hat Enterprise Linux 6 through 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm) — are recorded as not affected because the vulnerable code is not present in the shipped kernel builds, so no Red Hat kernel update is required for this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.