CVE-2026-80785
Received Received - Intake

Race Condition in Linux Kernel Framebuffer Subsystem

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: serialize mode sysfs access with lock_fb_info() show_mode(), show_modes(), and store_mode() access fb_info->modelist and fb_info->mode without holding lock_fb_info(). store_modes() takes lock_fb_info() while replacing the modelist and freeing the old one. A concurrent reader or writer can load a pointer to an old modelist entry before store_modes() frees it, then dereference freed memory or store a stale freed pointer in fb_info->mode. Take lock_fb_info() in show_mode(), show_modes(), and store_mode() to serialize with store_modes(). In show_mode(), copy the mode to the stack and format after dropping the lock. In store_mode(), split activate() into a _locked variant to avoid double-locking, and hold the locks for the modelist walk, mode conversion, activation, and fb_info->mode assignment together.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80785
EUVD
EUVD-2026-71428

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's framebuffer device (fbdev) subsystem. The vulnerability occurs when multiple processes access the framebuffer's mode settings simultaneously without proper synchronization. The functions show_mode(), show_modes(), and store_mode() read or modify framebuffer mode information without holding a lock, while store_modes() holds a lock when updating the mode list. This can lead to a use-after-free condition where a process reads a pointer to freed memory or stores a stale pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's fbdev subsystem and requires kernel-level inspection. Detection involves checking kernel logs for memory corruption or crashes related to framebuffer operations. Use commands like dmesg | grep -i fb or journalctl -k | grep -i fb to inspect kernel logs for errors. If you suspect exploitation, monitor for kernel panics or memory corruption events.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior in applications using the framebuffer device. In severe cases, it might allow local attackers to escalate privileges or execute arbitrary code with kernel privileges. Users may experience graphical glitches, system freezes, or kernel panics.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch this vulnerability. If immediate patching is not possible, restrict access to framebuffer devices via permissions or disable unnecessary framebuffer modules. Monitor kernel security advisories for updates and consider isolating systems using vulnerable kernels.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80785. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart