Executive brief
The Linux kernel's framebuffer device sysfs interface has a buffer overflow vulnerability in the mode list display functionality. When a system has a long list of video modes, the mode information can overflow the fixed-size sysfs output buffer, potentially allowing local users to read or write memory outside intended boundaries and gain elevated privileges or crash the system.
Technical details
The vulnerability is a buffer overflow in drivers/video/fbdev/core/fbsysfs.c, specifically in the mode_string() and show_modes() functions. The root cause is that mode_string() uses snprintf() which can return a value larger than the remaining buffer space, and show_modes() accumulates these return values into an offset counter without checking whether the offset has reached PAGE_SIZE (4096 bytes on most systems). When a system has many video modes configured, this causes writes to exceed the sysfs buffer boundary. The fix involves switching to scnprintf() (which returns only bytes actually written), adding a size parameter to mode_string(), and adding early termination checks. The vulnerability affects Linux kernel v7.1 and later, with the patch applied to stable branches. Local access to sysfs is required; this is typically available to unprivileged users on most systems.
Affected products
- Linux Linux kernel v7.1 and later
Timeline
- 2026-08-26: disclosed
- 2026-08-08: patched: Upstream fix commit d15d51fb26e830af58f3f21964f1c09c239077ea