Executive brief
The Linux kernel's framebuffer device (fbdev) subsystem had an unsynchronized access bug in its mode-setting sysfs interface. Multiple functions reading or writing display mode configuration could access freed memory or stale pointers when mode lists were being replaced concurrently, potentially causing system crashes or undefined behavior.
Technical details
The vulnerability is a race condition (CWE-362) in the fbdev sysfs interface. The functions show_mode(), show_modes(), and store_mode() accessed fb_info->modelist and fb_info->mode without holding lock_fb_info(), while store_modes() held the lock during modelist replacement and freeing. A concurrent reader or writer could load a pointer to a freed modelist entry before store_modes() freed it, then dereference freed memory or store a dangling pointer. The fix adds proper locking (lock_fb_info()) around all mode list accesses, with careful coordination to avoid double-locking. The vulnerability affects Linux kernel v7.1 and later; exploitation requires local filesystem access to sysfs attributes (typically /sys/class/graphics/).
Affected products
- Linux Linux kernel 7.1+
Timeline
- 2026-09-04: disclosed
- 2026-08-08: patched