CVE-2026-80580
Received Received - Intake

fbdev Buffer Overflow in Linux Kernel

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough. Add a size parameter to mode_string() and use scnprintf() to return only the bytes actually written. Add an early return when offset already exceeds the buffer. In show_modes(), stop accumulating once the buffer is full.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80580
EUVD
EUVD-2026-66495

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a buffer overflow risk in the fbdev subsystem. The mode_string() function uses snprintf() which can return a value exceeding the remaining buffer space. The show_modes() function accumulates this return value without checking if it reaches PAGE_SIZE, potentially causing the offset to exceed the sysfs buffer if the modelist is long enough.

Detection Guidance

This vulnerability is specific to the Linux kernel's fbdev subsystem and involves a buffer overflow in sysfs output handling. Detection requires checking the kernel version and examining sysfs entries related to display modes. Commands like uname -a to check kernel version and ls /sys/class/graphics/ to inspect fbdev sysfs entries may help identify affected systems.

Impact Analysis

An attacker could exploit this to cause a denial of service or execute arbitrary code in the kernel, leading to system instability or unauthorized access. Systems using affected Linux kernel versions may crash or become vulnerable to further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance penalties if systems are compromised due to this flaw.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel security advisories and apply patches promptly. If immediate patching is not possible, consider disabling the affected fbdev subsystem if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80580. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart