Linux Kernel Vulnerability in fbdev Affects Video Mode Management

CVE-2026-80579

What is CVE-2026-80579?

A vulnerability exists in the Linux kernel's fbdev subsystem, which may lead to dereferencing a stale pointer. The issue arises when fb_set_var() deletes a mode from the modelist based on user input via FBIOPUT_VSCREENINFO, without accurately clearing the fb_info->mode. Should this pointer remain intact after its associated mode is deleted, subsequent sysfs reads through show_mode() can lead to unpredictable behavior, potentially impacting the stability of the entire system.

References