https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:08:19 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74320 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>fbdev: sm501fb: Fix buffer errors in OF binding code</p> <p>The code that gets the frame buffer mode from OF has &#39;use after free&#39;, &#39;buffer overrun&#39; and memory leaks.</p> <p>info-&gt;edid_data isn&#39;t free if the probe functions fail or if pd-&gt;def_mode is set.</p> <p>If both the CRT and PANEL are enabled info-&gt;edid_data is used after being freed and is freed twice.</p> <p>The string returned by of_get_property(np, &#34;mode&#34;, &amp;len) is just written over either the static &#34;640x480-16@60&#34; or the module parameter string without any regard for the length (which is most likely longer).</p> <p>Use kstrump() for the OF mode and free everything before freeing &#39;info.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>fbdev: sm501fb: Fix buffer errors in OF binding code</p> <p>The code that gets the frame buffer mode from OF has &#39;use after free&#39;, &#39;buffer overrun&#39; and memory leaks.</p> <p>info-&gt;edid_data isn&#39;t free if the probe functions fail or if pd-&gt;def_mode is set.</p> <p>If both the CRT and PANEL are enabled info-&gt;edid_data is used after being freed and is freed twice.</p> <p>The string returned by of_get_property(np, &#34;mode&#34;, &amp;len) is just written over either the static &#34;640x480-16@60&#34; or the module parameter string without any regard for the length (which is most likely longer).</p> <p>Use kstrump() for the OF mode and free everything before freeing &#39;info.</p> https://vulnerability.circl.lu/vuln/cve-2026-74320