CVE-2026-74320

In the Linux kernel, the following vulnerability has been resolved: fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks. info->edid_data isn't free if the probe functions fail or if pd->def_mode is set. If both the CRT and PANEL are enabled info->edid_data is used after being freed and is freed twice. The string returned by of_get_property(np, "mode", &len) is just written over either the static "640x480-16@60" or the module parameter string without any regard for the length (which is most likely longer). Use kstrump() for the OF mode and free everything before freeing 'info.

Affected products

Kernel, Linux, Linux-Allwinner-5.19, Linux-Aws, Linux-Aws-5.0, Linux-Aws-5.11, Linux-Aws-5.13, Linux-Aws-5.15

EPSS

0.2% (7th percentile)

NVD status

Received

Published

2026-08-15

No exploit for CVE-2026-74320 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.