GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80579 (GCVE-0-2026-80579)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:02
VLAI
Title
fbdev: clear fb_info->mode before deleting a videomode
Summary
In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fb_info->mode before deleting a videomode fb_set_var() can delete a mode from info->modelist when userspace passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code checks that the mode being deleted is not the current info->var and that fbcon is not using it, but it does not check fb_info->mode. fb_info->mode may still point into the modelist entry being deleted. If the entry is freed, later mode sysfs reads through show_mode() can dereference a stale pointer. Clear fb_info->mode before calling fb_delete_videomode() when it matches the mode being removed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ce7fef961c63229b22dec415fb988899f479d61f (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 95e647d2a5304a8fd11f1ba3c8502de700650131 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.12
Unaffected: 0 , < 2.6.12 (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ce7fef961c63229b22dec415fb988899f479d61f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "95e647d2a5304a8fd11f1ba3c8502de700650131",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: clear fb_info-\u003emode before deleting a videomode\n\nfb_set_var() can delete a mode from info-\u003emodelist when userspace\npasses FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code\nchecks that the mode being deleted is not the current info-\u003evar and\nthat fbcon is not using it, but it does not check fb_info-\u003emode.\n\nfb_info-\u003emode may still point into the modelist entry being deleted.\nIf the entry is freed, later mode sysfs reads through show_mode() can\ndereference a stale pointer.\n\nClear fb_info-\u003emode before calling fb_delete_videomode() when it\nmatches the mode being removed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local framebuffer interfaces\u2014FBIOPUT_VSCREENINFO ioctl on /dev/fb* to delete a videomode and sysfs reads of /sys/class/graphics/fb*/mode via show_mode(); fbdev core has no network, Bluetooth, or remote packet path.\nAC:L - Exploitation is a deterministic state bug, not a race: ioctl with FB_ACTIVATE_INV_MODE frees the modelist kmalloc entry while fb_info-\u003emode still points into it, and a subsequent sysfs mode read reliably dereferences the stale pointer without attacker-uncontrollable timing.\nPR:L - The freeing trigger is FBIOPUT_VSCREENINFO on /dev/fb*, which requires only local framebuffer device access (video group or kiosk/embedded/HMI service accounts), not init-namespace root; sysfs mode reads are world-readable and complete the UAF disclosure path.\nUI:N - No victim interaction is required; the attacker performs ioctl mode deletion and sysfs mode reads through their own local process without needing another user to mount, open, or configure unrelated resources.\nS:U - The use-after-free corrupts kernel heap state within the local fbdev subsystem and does not cross VM, container, or IOMMU boundaries to impact resources under a different security authority.\nC:H - After fb_delete_videomode() kfree()s the fb_modelist object, show_mode()/mode_string() reads flag, vmode, xres, yres, and refresh from freed slab memory and copies attacker-influenced bytes to userspace\u2014a UAF information-disclosure primitive.\nI:H - The dangling fb_info-\u003emode pointer into a freed kmalloc object enables classic heap grooming between ioctl free and sysfs read; reallocated slab contents can be corrupted or confused for control-flow or arbitrary-write primitives beyond the immediate read.\nA:H - Dereferencing the freed fb_videomode structure causes KASAN-detectable use-after-free faults and kernel oops/panic on display-equipped embedded, automotive, kiosk, and console systems running the framebuffer subsystem."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:02:00.629Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ce7fef961c63229b22dec415fb988899f479d61f"
        },
        {
          "url": "https://git.kernel.org/stable/c/95e647d2a5304a8fd11f1ba3c8502de700650131"
        }
      ],
      "title": "fbdev: clear fb_info-\u003emode before deleting a videomode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80579",
    "datePublished": "2026-08-26T14:37:37.320Z",
    "dateReserved": "2026-08-26T14:34:25.769Z",
    "dateUpdated": "2026-08-27T05:02:00.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80579",
      "date": "2026-09-16",
      "epss": "0.00112",
      "percentile": "0.01552"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-27T01:04:27.000Z",
      "cve": "CVE-2026-80579",
      "id": "msrc_CVE-2026-80579",
      "initial_release_date": "2026-08-27T01:04:27.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "fbdev: clear fb_info-\u003emode before deleting a videomode",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80579.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80579\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:14.007\",\"lastModified\":\"2026-08-27T06:17:44.093\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfbdev: clear fb_info-\u003emode before deleting a videomode\\n\\nfb_set_var() can delete a mode from info-\u003emodelist when userspace\\npasses FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code\\nchecks that the mode being deleted is not the current info-\u003evar and\\nthat fbcon is not using it, but it does not check fb_info-\u003emode.\\n\\nfb_info-\u003emode may still point into the modelist entry being deleted.\\nIf the entry is freed, later mode sysfs reads through show_mode() can\\ndereference a stale pointer.\\n\\nClear fb_info-\u003emode before calling fb_delete_videomode() when it\\nmatches the mode being removed.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/video/fbdev/core/fbmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"ce7fef961c63229b22dec415fb988899f479d61f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"95e647d2a5304a8fd11f1ba3c8502de700650131\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/video/fbdev/core/fbmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/95e647d2a5304a8fd11f1ba3c8502de700650131\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ce7fef961c63229b22dec415fb988899f479d61f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T14:55:06+00:00",
      "cve": "CVE-2026-80579",
      "id": "CVE-2026-80579",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fbdev: clear fb_info-\u003emode before deleting a videomode",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80579.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:11:16Z",
      "cve": "CVE-2026-80579",
      "id": "CVE-2026-80579",
      "initial_release_date": "2026-08-27T00:11:30Z",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80579",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80579.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.