CVE-2026-43123: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43123 Overview

CVE-2026-43123 is a NULL pointer dereference vulnerability in the Linux kernel's framebuffer console (fbcon) subsystem. The flaw exists because con2fb_acquire_newinfo() did not have its return value checked by callers. When fbcon_open() fails inside con2fb_acquire_newinfo(), the info->fbcon_par pointer remains NULL and is later dereferenced, leading to a kernel crash. The issue was identified by the Linux Verification Center (linuxtesting.org) using the SVACE static analysis tool. The patch adds a return value check on con2fb_acquire_newinfo() to prevent the dereference.

Critical Impact
A failure path in the framebuffer console subsystem can trigger a kernel-mode NULL pointer dereference, resulting in denial of service through a kernel oops or panic.

Affected Products

Linux kernel (mainline) — drivers/video/fbdev/core/fbcon.c
Stable Linux kernel branches referenced in the upstream fix commits
Linux distributions packaging affected kernel versions prior to backport

Discovery Timeline

2026-05-06 - CVE-2026-43123 published to the National Vulnerability Database (NVD)
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43123

Vulnerability Analysis

The vulnerability resides in the Linux framebuffer console driver (fbcon), which provides text-mode console rendering on top of framebuffer devices. The function con2fb_acquire_newinfo() is responsible for binding a virtual console to a new framebuffer info structure and initializing the per-fb console parameter pointer info->fbcon_par via fbcon_open().

If fbcon_open() returns an error during this acquisition path, the function exits without initializing info->fbcon_par, leaving it as NULL. Callers of con2fb_acquire_newinfo() did not check the return value and continued execution under the assumption that initialization succeeded. Subsequent code paths dereference info->fbcon_par, triggering a kernel NULL pointer dereference.

The defect maps to [CWE-476: NULL Pointer Dereference]. The upstream fix adds the missing return-value check so callers abort the operation when con2fb_acquire_newinfo() fails.

Root Cause

The root cause is unchecked error propagation from a fallible initialization routine. con2fb_acquire_newinfo() can fail because of an error returned from fbcon_open(), but the calling code did not validate the result before relying on the side effect of info->fbcon_par being set. This is a classic missing-error-check pattern in C kernel code.

Attack Vector

Triggering the dereference requires interacting with the framebuffer console subsystem in a way that forces fbcon_open() to fail during con2fb_acquire_newinfo(). Such interactions typically require local access to the system, for example through ioctl calls on /dev/fb* devices or console binding operations. Successful exploitation results in a kernel oops or panic, producing a local denial-of-service condition. There is no public evidence of remote exploitation or memory corruption beyond the NULL dereference itself.

No public proof-of-concept exploit code is available. See the upstream commits for the precise fix, including Linux Kernel Commit 011a050 and Linux Kernel Commit 11a9318.

Detection Methods for CVE-2026-43123

Indicators of Compromise

Kernel oops or panic messages referencing fbcon, con2fb_acquire_newinfo, or fbcon_open in dmesg or /var/log/kern.log.
NULL pointer dereference traces with fbcon_par appearing in the faulting instruction context.
Unexpected console subsystem failures or crashes following framebuffer device binding operations.

Detection Strategies

Inventory running kernels with uname -r and compare against the fixed versions referenced by the upstream stable commits.
Use vulnerability scanners that consume NVD feeds to flag hosts running unpatched kernel builds.
Audit kernel crash dumps and kdump output for stack traces involving the fbcon call chain.

Monitoring Recommendations

Forward dmesg and kernel ring buffer events to a centralized logging or SIEM platform for correlation.
Alert on repeated kernel oops events on the same host, which can indicate exploitation attempts or buggy local code paths.
Monitor for unexpected reboots and kernel panics on systems exposing framebuffer consoles, particularly multi-user Linux hosts.

How to Mitigate CVE-2026-43123

Immediate Actions Required

Apply the upstream Linux kernel patch that adds the return-value check on con2fb_acquire_newinfo().
Update to a distribution kernel package that backports one of the referenced stable commits.
Restrict local access to systems exposing framebuffer console devices until patching is complete.

Patch Information

The vulnerability is fixed by adding a check on the return value of con2fb_acquire_newinfo() so callers do not proceed when fbcon_open() fails. The fix is available across multiple stable branches via the following upstream commits: Linux Kernel Commit 011a050, Linux Kernel Commit 0b038c0, Linux Kernel Commit 11a9318, Linux Kernel Commit 3b5a754, Linux Kernel Commit a785c4e, Linux Kernel Commit d3e5355, and Linux Kernel Commit f57b616.

Workarounds

Limit local user access on shared Linux hosts to reduce exposure to console-subsystem attack paths.
Where the framebuffer console is not required, blacklist or unload the fbcon module to remove the vulnerable code path.
Restrict permissions on /dev/fb* devices so that only trusted users and services can interact with them.

bash

# Configuration example: prevent fbcon from loading where it is not needed
echo 'blacklist fbcon' | sudo tee /etc/modprobe.d/blacklist-fbcon.conf
sudo update-initramfs -u

# Restrict access to framebuffer devices
sudo chmod 600 /dev/fb*