The Linux kernel’s legacy framebuffer driver for S3 Savage hardware contains a simple-but-serious error‑handling bug that can be triggered locally to crash a host kernel: a missing check in the savagefb probe path fails to handle an error return from savagefb_check_var, allowing a zero-valued...