CVE-2021-47652

video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()

I got a null-ptr-deref report:

BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:fb_destroy_modelist+0x38/0x100 ... Call Trace: ufx_usb_probe.cold+0x2b5/0xac1 [smscufx] usb_probe_interface+0x1aa/0x3c0 [usbcore] really_probe+0x167/0x460 ... ret_from_fork+0x1f/0x30

If fb_alloc_cmap() fails in ufx_usb_probe(), fb_destroy_modelist() will be called to destroy modelist in the error handling path. But modelist has not been initialized yet, so it will result in null-ptr-deref.

Initialize modelist before calling fb_alloc_cmap() to fix this bug.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before d1b6a1f0c23b7164250479bf92e2893291dca539Affected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 0fd28daec73525382e5c992db8743bf76e42cd5cAffected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before dd3a6cc7385b89ec2303f39dfc3bafa4e24cec4bAffected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before da8b269cc0a2526ebeaccbe2484c999eb0f822cfAffected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 64ec3e678d76419f207b9cdd338dda438ca10b1cAffected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before c420b540db4b5d69de0a36d8b9d9a6a79a04f05aAffected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before d396c651e2b508b6179bb678cc029f3becbf5170Affected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 9280ef235b05e8f19f8bc6d547b992f0a0ef398dAffected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 1791f487f877a9e83d81c8677bd3e7b259e7cb27Affected
LinuxLinux	3.2Affected before 3.2Not affected 4.9.311 through 4.9.Not affected 4.14.276 through 4.14.Not affected 4.19.238 through 4.19.Not affected 5.4.189 through 5.4.Not affected 5.10.110 through 5.10.Not affected 5.15.33 through 5.15.Not affected 5.16.19 through 5.16.Not affected 5.17.2 through 5.17.Not affected 5.18 and laterNot affected

Product

Versions

LinuxLinux

3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before d1b6a1f0c23b7164250479bf92e2893291dca539Affected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 0fd28daec73525382e5c992db8743bf76e42cd5cAffected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before dd3a6cc7385b89ec2303f39dfc3bafa4e24cec4bAffected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before da8b269cc0a2526ebeaccbe2484c999eb0f822cfAffected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 64ec3e678d76419f207b9cdd338dda438ca10b1cAffected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before c420b540db4b5d69de0a36d8b9d9a6a79a04f05aAffected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before d396c651e2b508b6179bb678cc029f3becbf5170Affected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 9280ef235b05e8f19f8bc6d547b992f0a0ef398dAffected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 1791f487f877a9e83d81c8677bd3e7b259e7cb27Affected

LinuxLinux

3.2Affected
before 3.2Not affected
4.9.311 through 4.9.*Not affected
4.14.276 through 4.14.*Not affected
4.19.238 through 4.19.*Not affected
5.4.189 through 5.4.*Not affected
5.10.110 through 5.10.*Not affected
5.15.33 through 5.15.*Not affected
5.16.19 through 5.16.*Not affected
5.17.2 through 5.17.*Not affected
5.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.