Medium 5.5Published May 6, 2026

CVE-2026-43123fbcon: check return value of con2fb_acquire_newinfo()

Updated under an hour ago (Oct 28, 2026, 9:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: fbcon: check return value of con2fb_acquire_newinfo() If fbcon_open() fails when called from con2fb_acquire_newinfo() then info->fbcon_par pointer remains NULL which is later dereferenced. Add check for return value of the function con2fb_acquire_newinfo() to avoid it. Found by Linux Verification Center (linuxtesting.org) with SVACE.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e before d3e535533767c85788529e626478718b7e95a59f; from d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e before 3b5a754ec86bc6064af9aca76eb191c2405e6b0c; from d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e before a785c4e2a999c2d51dfcf40d317cfb30cc735d2c; from d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e before 0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc; from d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e before 11a93180a70bb3095a9bd80d113d9277e30d9959; from d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e before f57b61624c86ef8f87f6e6b7dd0755de03d90e89; from d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e before 011a0502801c8536f64141a2b61362c14f456544	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.23 before 5.15.203; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/d3e535533767c85788529e626478718b7e95a59f	patch
https://git.kernel.org/stable/c/3b5a754ec86bc6064af9aca76eb191c2405e6b0c	patch
https://git.kernel.org/stable/c/a785c4e2a999c2d51dfcf40d317cfb30cc735d2c	patch
https://git.kernel.org/stable/c/0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc	patch
https://git.kernel.org/stable/c/11a93180a70bb3095a9bd80d113d9277e30d9959	patch
https://git.kernel.org/stable/c/f57b61624c86ef8f87f6e6b7dd0755de03d90e89	patch
https://git.kernel.org/stable/c/011a0502801c8536f64141a2b61362c14f456544	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.