CVE-2026-80785: Linux Kernel fbdev Use-After-Free Vulnerability

CVE-2026-80785 Overview

CVE-2026-80785 is a Linux kernel vulnerability in the framebuffer device (fbdev) subsystem. The flaw affects the sysfs interface used to read and modify display modes. Functions show_mode(), show_modes(), and store_mode() access fb_info->modelist and fb_info->mode without holding lock_fb_info(). A concurrent call to store_modes() can free the old modelist while another thread still holds a pointer into it. The result is a use-after-free condition that can dereference freed memory or persist a stale pointer in fb_info->mode.

Critical Impact
Concurrent sysfs access to framebuffer mode attributes can trigger use-after-free of kernel memory, enabling potential denial of service or memory corruption on affected Linux systems.

Affected Products

Linux kernel framebuffer device (fbdev) subsystem
Distributions shipping vulnerable Linux kernel versions prior to the upstream fix
Systems exposing framebuffer mode and modes sysfs attributes

Discovery Timeline

2026-09-04 - CVE-2026-80785 published to NVD
2026-09-07 - Last updated in NVD database

Technical Details for CVE-2026-80785

Vulnerability Analysis

The vulnerability lives in the fbdev sysfs handlers that expose display mode information to user space. show_mode() reads the current mode from fb_info->mode, while show_modes() walks the linked list at fb_info->modelist. store_mode() looks up a requested mode by name and activates it. None of these paths acquired lock_fb_info() before touching the shared state.

Meanwhile, store_modes() correctly takes lock_fb_info() when it replaces the entire modelist and frees the previous list entries. Because the readers and the modifier do not share a lock, a reader can obtain a pointer into the old list, block, and then dereference memory that store_modes() has already freed. The upstream patch takes lock_fb_info() in all three unprotected handlers to serialize access.

Root Cause

The root cause is missing synchronization between concurrent producers and consumers of fb_info->modelist and fb_info->mode. The class falls under kernel race conditions and Use-After-Free. show_mode() also needed to be refactored to copy the mode onto the stack before dropping the lock and formatting the output. store_mode() required splitting activate() into a _locked variant so the modelist walk, mode conversion, activation, and assignment to fb_info->mode execute under a single lock hold without deadlocking.

Attack Vector

Exploitation requires local access to write and read the framebuffer sysfs attributes, typically under /sys/class/graphics/fbN/. A local user or process with sufficient privileges to trigger store_modes() while another thread reads mode or modes can race the free against the dereference. Successful races may cause kernel memory corruption, crashes, or information disclosure depending on the allocator state. See the upstream fix commits for the exact code paths: Kernel Git Commit 061db6b and Kernel Git Commit 2613563.

Detection Methods for CVE-2026-80785

Indicators of Compromise

Kernel oops or panic messages referencing fb_info, modelist, show_mode, show_modes, or store_mode in dmesg and /var/log/kern.log.
KASAN reports flagging use-after-free in the fbdev sysfs handlers on instrumented kernels.
Unexpected framebuffer resets or display artifacts correlated with sysfs writes to mode or modes.

Detection Strategies

Audit local processes writing to /sys/class/graphics/fb*/mode and /sys/class/graphics/fb*/modes using auditd file watches.
Compare running kernel version against the fixed upstream commits 061db6b7a910 and 26135631ed8e to identify unpatched hosts.
Enable KASAN in non-production kernels to surface latent use-after-free conditions during fuzzing or QA.

Monitoring Recommendations

Forward kernel logs to a central log platform and alert on fbdev-related oops signatures.
Track sysfs write activity from non-root or unexpected service accounts targeting graphics device attributes.
Monitor process crashes and kernel reboots on graphical endpoints and headless servers with framebuffer support compiled in.

How to Mitigate CVE-2026-80785

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 061db6b7a910 and 26135631ed8e or install vendor kernel updates that include them.
Restrict write access to framebuffer sysfs attributes to trusted administrators using file permissions and Mandatory Access Control policies.
Inventory systems running framebuffer-enabled kernels and prioritize patch deployment on multi-user hosts.

Patch Information

The fix serializes all sysfs mode access with lock_fb_info(). show_mode() copies the mode to a stack buffer and formats after dropping the lock. store_mode() uses a new _locked activation variant so the modelist walk, mode conversion, activation, and fb_info->mode assignment complete under one lock. Reference the patches at Kernel Git Commit 061db6b and Kernel Git Commit 2613563.

Workarounds

Tighten permissions on /sys/class/graphics/fb*/mode and /sys/class/graphics/fb*/modes so only root can write mode data.
Disable or unload the framebuffer subsystem on servers that do not require console graphics.
Use SELinux or AppArmor policies to block untrusted processes from writing framebuffer sysfs attributes.

bash

# Restrict framebuffer sysfs mode attributes to root-only access
for attr in /sys/class/graphics/fb*/mode /sys/class/graphics/fb*/modes; do
  [ -e "$attr" ] && chmod 600 "$attr"
done

# Verify installed kernel includes the fix commits
uname -r
zgrep -E 'fbdev.*lock_fb_info' /usr/share/doc/linux-image-*/changelog.Debian.gz 2>/dev/null