Riskcovery

CVE-2026-80579

fbdev: clear fb_info->mode before deleting a videomode

State
Published
Severity
7.8 High
Published
Aug 26, 2026
Updated
Oct 16, 2026
Reserved
Aug 26, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: clear fb_info->mode before deleting a videomode

fb_set_var() can delete a mode from info->modelist when userspace passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code checks that the mode being deleted is not the current info->var and that fbcon is not using it, but it does not check fb_info->mode.

fb_info->mode may still point into the modelist entry being deleted. If the entry is freed, later mode sysfs reads through show_mode() can dereference a stale pointer.

Clear fb_info->mode before calling fb_delete_videomode() when it matches the mode being removed.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ce7fef961c63229b22dec415fb988899f479d61fAffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 95e647d2a5304a8fd11f1ba3c8502de700650131Affected
LinuxLinux
  • 2.6.12Affected
  • before 2.6.12Not affected
  • 7.1.10 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.