CVE-2026-80579 Overview
CVE-2026-80579 is a use-after-free vulnerability in the Linux kernel framebuffer device (fbdev) subsystem. The flaw resides in fb_set_var(), which can delete a videomode from info->modelist when userspace passes the FB_ACTIVATE_INV_MODE flag through the FBIOPUT_VSCREENINFO ioctl. The deletion path checks that the mode is not the current info->var and that fbcon is not using it, but it fails to check fb_info->mode. If fb_info->mode still points into the freed modelist entry, subsequent sysfs reads via show_mode() dereference a stale pointer.
Critical Impact
A local authenticated user can trigger memory corruption in the Linux kernel through the framebuffer ioctl interface, potentially leading to privilege escalation or denial of service.
Affected Products
- Linux kernel framebuffer device (fbdev) subsystem
- Distributions shipping vulnerable kernel versions prior to the fix commits
- Systems exposing /dev/fb* devices to unprivileged or semi-privileged users
Discovery Timeline
- 2026-08-26 - CVE-2026-80579 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80579
Vulnerability Analysis
The vulnerability is a use-after-free [CWE-416] in the Linux kernel fbdev driver. The framebuffer subsystem maintains a linked list of video modes in fb_info->modelist and a pointer to the currently active mode in fb_info->mode. When userspace invokes the FBIOPUT_VSCREENINFO ioctl with the FB_ACTIVATE_INV_MODE activation flag, the kernel calls fb_set_var(), which may remove a mode from the modelist via fb_delete_videomode().
The existing safety checks verify that the mode being removed does not match the current var structure and that the framebuffer console is not currently rendering with it. These checks are incomplete. The fb_info->mode pointer may still reference the modelist entry scheduled for deletion. Once fb_delete_videomode() frees the underlying memory, fb_info->mode becomes a dangling pointer.
Later reads of the mode sysfs attribute traverse show_mode(), which dereferences fb_info->mode. This produces an out-of-bounds read against freed slab memory and can leak kernel information or corrupt state depending on allocator reuse.
Root Cause
The root cause is missing state synchronization between fb_info->mode and the modelist during videomode deletion. fb_set_var() does not clear or reassign fb_info->mode before calling fb_delete_videomode() when the deleted entry matches the cached pointer. The fix clears fb_info->mode prior to deletion when it references the target entry.
Attack Vector
Exploitation requires local access with permission to open a framebuffer device such as /dev/fb0 and issue the FBIOPUT_VSCREENINFO ioctl. An attacker crafts an fb_var_screeninfo structure with the FB_ACTIVATE_INV_MODE flag set to trigger the vulnerable deletion path. Reading the mode sysfs entry afterward dereferences the freed memory. Reliable exploitation involves grooming the slab to place attacker-controlled data at the freed address, enabling read primitives or control-flow influence in kernel context.
No public exploit code is currently available for this issue. Refer to the upstream commits 95e647d2a530 and ce7fef961c63 for the corrective patch details.
Detection Methods for CVE-2026-80579
Indicators of Compromise
- Kernel oops or panic messages referencing show_mode, fb_delete_videomode, or fb_set_var in dmesg or /var/log/kern.log
- KASAN reports flagging use-after-free access in the fbdev subsystem when kernel address sanitizer is enabled
- Unexpected processes issuing FBIOPUT_VSCREENINFO ioctls against /dev/fb* devices
Detection Strategies
- Audit kernel version against the fix commits 95e647d2a530 and ce7fef961c63 to identify unpatched hosts
- Enable KASAN and syzkaller-style fuzzing in test environments to surface fbdev slab corruption paths
- Correlate openat and ioctl syscall telemetry on /dev/fb* devices with subsequent sysfs reads of mode attributes under /sys/class/graphics/fb*/
Monitoring Recommendations
- Collect kernel ring buffer messages centrally and alert on framebuffer subsystem stack traces
- Monitor for non-graphical processes accessing framebuffer devices, which is atypical on server workloads
- Track loading of the fbdev module on systems where headless operation is expected
How to Mitigate CVE-2026-80579
Immediate Actions Required
- Apply the upstream kernel patches referenced in commits 95e647d2a530 and ce7fef961c63 or update to a distribution kernel that includes the fix
- Restrict access to /dev/fb* devices by tightening group membership and udev rules on multi-user systems
- Unload or blacklist the fbdev module on headless servers where framebuffer support is not required
Patch Information
The fix clears fb_info->mode before calling fb_delete_videomode() when the pointer matches the mode being removed. This closes the use-after-free window on subsequent sysfs reads. Refer to the kernel commit 95e647d2a530 and the kernel commit ce7fef961c63 for the corrective changes.
Workarounds
- Blacklist the fbdev module by adding blacklist fbdev to /etc/modprobe.d/ where framebuffer output is not required
- Restrict framebuffer device permissions to root only using udev rules such as KERNEL=="fb[0-9]*", MODE="0600", OWNER="root"
- Enforce mandatory access control policies via SELinux or AppArmor to limit which processes may issue ioctls against /dev/fb*
# Configuration example
# /etc/modprobe.d/disable-fbdev.conf
blacklist fbdev
# /etc/udev/rules.d/99-fbdev-restrict.rules
KERNEL=="fb[0-9]*", MODE="0600", OWNER="root", GROUP="root"
# Verify kernel version includes the fix
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
