Riskcovery

CVE-2026-80786

fbdev: Wrap user-invoked calls to fb_set_var() in helper

State
Published
Severity
Not scored
Published
Sep 4, 2026
Updated
Oct 30, 2026
Reserved
Aug 26, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: Wrap user-invoked calls to fb_set_var() in helper

Handle fbcon during display updates in fb_set_var_from_user(). Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers.

Only the FBIOPUT_VSCREENINFO ioctl currently does all steps. Other mode-changes callers in sysfs and driver code are missing fbcon-related steps.

With the new helper, ps3fb and sh_mobile_lcdcfb no longer maintain fbcon state themselves.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before af39d039b5591e3ebaa2e013862bd8cacc6d9dc3Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3130e7bf43ecfe3a15bcf90b9698e0764a2d8d08Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d33589eff3d40439b3c83e8da0d07d20df797d50Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ed7e9715849abd0816b8487b0d12ebd05d6e938bAffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 07f7e46833f71472e30da54a50dacdf48521bdd3Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6f611e5e5f3327cf2e2daabe6ee5acac58cc784eAffected
LinuxLinux
  • 2.6.12Affected
  • before 2.6.12Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.1.11 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.