Linux Kernel CVE-2026-53403

The vulnerability resides in the Linux kernel fbdev (framebuffer device) subsystem, affecting all major stable branches from 5.10 through 7.x (CPE: cpe:2.3:a:linux:linux). The root cause is CWE-476 (NULL Pointer Dereference) arising from a broken kernel invariant: info->var (the current active framebuffer video mode) is always expected to have a corresponding entry in info->modelist. Functions such as fb_set_var() and do_register_framebuffer() maintain this invariant diligently. However, fb_new_modelist() - invoked through the sysfs store_modes interface - replaces the entire modelist from userspace without verifying that the currently active mode survives the replacement. The recovery path through fbcon_new_modelist() only corrects consoles actively mapped to the framebuffer; when fbcon is unbound (e.g., while a display server holds the framebuffer), no mapped consoles exist, so the invariant is silently broken. When a console later takes over, var_to_display() calls fb_match_mode(), which returns NULL, leaving fb_display[i].mode NULL. fbcon_switch() passes this to display_to_var(), which calls fb_videomode_to_var() and dereferences the NULL pointer, causing a kernel panic. The fix mirrors what fb_set_var() already does: ensure the current mode is retained in the list inside fb_new_modelist().