---
id: CVE-2026-43123
title: 'fbcon: check return value of con2fb_acquire_newinfo()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fbcon: check return value of con2fb_acquire_newinfo()

  If fbcon_open() fails when called from con2fb_acquire_newinfo() then
  info->fbcon_par pointer remains NULL which i…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e <
    d3e535533767c85788529e626478718b7e95a59f
  - >-
    Linux >= d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e <
    3b5a754ec86bc6064af9aca76eb191c2405e6b0c
  - >-
    Linux >= d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e <
    a785c4e2a999c2d51dfcf40d317cfb30cc735d2c
  - >-
    Linux >= d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e <
    0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc
  - >-
    Linux >= d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e <
    11a93180a70bb3095a9bd80d113d9277e30d9959
  - >-
    Linux >= d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e <
    f57b61624c86ef8f87f6e6b7dd0755de03d90e89
  - >-
    Linux >= d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e <
    011a0502801c8536f64141a2b61362c14f456544
  - Linux 2.6.23
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:28:47.782222Z'
published: '2026-05-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:31.959Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43123'
references:
  - url: 'https://git.kernel.org/stable/c/d3e535533767c85788529e626478718b7e95a59f'
  - url: 'https://git.kernel.org/stable/c/3b5a754ec86bc6064af9aca76eb191c2405e6b0c'
  - url: 'https://git.kernel.org/stable/c/a785c4e2a999c2d51dfcf40d317cfb30cc735d2c'
  - url: 'https://git.kernel.org/stable/c/0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc'
  - url: 'https://git.kernel.org/stable/c/11a93180a70bb3095a9bd80d113d9277e30d9959'
  - url: 'https://git.kernel.org/stable/c/f57b61624c86ef8f87f6e6b7dd0755de03d90e89'
  - url: 'https://git.kernel.org/stable/c/011a0502801c8536f64141a2b61362c14f456544'
tags:
  - cve.org
epss: 0.00128
epssPercentile: 0.02469
ingestedAt: '2026-11-06T15:54:04.020Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fbcon: check return value of con2fb_acquire_newinfo()

If fbcon_open() fails when called from con2fb_acquire_newinfo() then
info->fbcon_par pointer remains NULL which is later dereferenced.

Add check for return value of the function con2fb_acquire_newinfo() to
avoid it.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

## Affected

- `Linux >= d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e < d3e535533767c85788529e626478718b7e95a59f`
- `Linux >= d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e < 3b5a754ec86bc6064af9aca76eb191c2405e6b0c`
- `Linux >= d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e < a785c4e2a999c2d51dfcf40d317cfb30cc735d2c`
- `Linux >= d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e < 0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc`
- `Linux >= d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e < 11a93180a70bb3095a9bd80d113d9277e30d9959`
- `Linux >= d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e < f57b61624c86ef8f87f6e6b7dd0755de03d90e89`
- `Linux >= d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e < 011a0502801c8536f64141a2b61362c14f456544`
- `Linux 2.6.23`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.