Executive brief
The Linux kernel's framebuffer device (fbdev) driver contains a use-after-free vulnerability in its video mode management code. When userspace requests deletion of a video mode through the FBIOPUT_VSCREENINFO ioctl, a stale pointer to the deleted mode can remain in memory. Subsequent reads of mode information through sysfs can crash the system or potentially be exploited by a local attacker to read kernel memory or gain elevated privileges.
Technical details
The vulnerability is a use-after-free in the fb_set_var() function in drivers/video/fbdev/core/fbmem.c. When a userspace application passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO ioctl to delete a video mode from the modelist, the code checks that the mode is not in use by fbcon or as the current video mode (info->var), but fails to check if fb_info->mode still points to the mode being deleted. After the mode is freed via fb_delete_videomode(), the stale pointer remains in fb_info->mode. Later, sysfs reads through show_mode() attempt to dereference this freed memory, causing a kernel crash or potential information disclosure. The fix clears fb_info->mode before deleting the mode if it matches the mode being removed. The vulnerability affects Linux kernel v7.1 and later, with patches available upstream.
Affected products
- Linux Linux kernel v7.1 and later
Timeline
- 2026-08-26: disclosed: CVE-2026-80579 published
- 2026-07-02: patched: Patch committed upstream (commit 95e647d2a5304a8fd11f1ba3c8502de700650131)
- 2026-08-08: patched: Patch in mainline (commit 95e647d2a5304a8fd11f1ba3c8502de700650131)
- 2026-08-23: patched: Patch backported to stable kernels (commit ce7fef961c63229b22dec415fb988899f479d61f)