CVE-2026-80786 Overview
CVE-2026-80786 affects the Linux kernel framebuffer device (fbdev) subsystem. The vulnerability stems from inconsistent handling of the framebuffer console (fbcon) during display mode updates. Only the FBIOPUT_VSCREENINFO ioctl performed the full sequence of checking with fbcon, updating hardware state, and refreshing fbcon. Other mode-change callers in sysfs and driver code omitted the fbcon-related steps, leaving the console subsystem in an inconsistent state after user-invoked mode changes.
The fix wraps user-invoked calls to fb_set_var() in a new helper, fb_set_var_from_user(), that consistently handles fbcon coordination. Drivers such as ps3fb and sh_mobile_lcdcfb no longer maintain fbcon state themselves after this change.
Critical Impact
Inconsistent fbcon state after user-triggered framebuffer mode changes can lead to display corruption or kernel state desynchronization on affected systems.
Affected Products
- Linux kernel fbdev subsystem (framebuffer device layer)
- Linux kernel ps3fb driver (PlayStation 3 framebuffer)
- Linux kernel sh_mobile_lcdcfb driver (SuperH Mobile LCDC framebuffer)
Discovery Timeline
- 2026-09-04 - CVE-2026-80786 published to NVD
- 2026-09-07 - Last updated in NVD database
Technical Details for CVE-2026-80786
Vulnerability Analysis
The Linux framebuffer subsystem exposes multiple paths for user space to trigger display mode changes. These include the FBIOPUT_VSCREENINFO ioctl and various sysfs attributes. Each path ultimately calls fb_set_var() to apply variable screen information to hardware.
Before the fix, only the ioctl path coordinated with the framebuffer console (fbcon) subsystem. Sysfs-driven mode changes and driver-internal callers skipped the coordination steps. This left fbcon unaware of hardware mode transitions initiated from user space.
The resolved patch introduces fb_set_var_from_user(), a helper that consolidates the correct sequence: query fbcon for compatibility, apply the hardware change, then notify fbcon of the new state. All user-invoked callers now route through this helper.
Root Cause
The root cause is missing state synchronization between the fbdev mode-setting logic and the fbcon console layer across non-ioctl entry points. Drivers including ps3fb and sh_mobile_lcdcfb previously duplicated partial fbcon bookkeeping. The absence of a single canonical helper produced divergent behavior across code paths.
Attack Vector
Exploitation requires a local user with access to framebuffer device nodes or writable sysfs attributes tied to the framebuffer. A local actor can trigger inconsistent fbcon state by issuing mode changes through the previously unhandled paths. See the upstream commits at kernel.org commit 07f7e468 and kernel.org commit 6f611e5e for the exact code paths modified.
No public proof-of-concept exploit is available. The vulnerability is described in prose because no verified exploit code has been released.
Detection Methods for CVE-2026-80786
Indicators of Compromise
- Unexpected framebuffer console corruption or blanking following writes to /sys/class/graphics/fb*/ attributes.
- Kernel log entries referencing fbcon state inconsistencies after mode changes from non-ioctl sources.
- Unprivileged processes making repeated writes to framebuffer sysfs mode attributes.
Detection Strategies
- Audit running kernel versions against the fixed commits 07f7e46833f7 and 6f611e5e5f33 in the stable tree.
- Enable kernel audit rules for writes to /sys/class/graphics/fb*/mode and related attributes.
- Correlate framebuffer sysfs writes with subsequent fbcon warnings in dmesg output.
Monitoring Recommendations
- Forward dmesg and journalctl -k output to a central log store and alert on fbcon or fbdev warning strings.
- Track access to /dev/fb* device nodes on multi-user Linux systems.
- Baseline expected framebuffer mode changes on embedded and console-only systems where changes should be rare.
How to Mitigate CVE-2026-80786
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 07f7e46833f7 and 6f611e5e5f33 once available in your distribution's stable kernel.
- Restrict access to /dev/fb* device nodes and framebuffer sysfs attributes to trusted users only.
- Inventory systems that rely on ps3fb or sh_mobile_lcdcfb drivers and prioritize their patching.
Patch Information
The fix is available in the upstream stable Linux kernel tree. Reference the commits at kernel.org commit 07f7e468 and kernel.org commit 6f611e5e. Track your distribution vendor's advisories for backported kernel packages.
Workarounds
- Tighten permissions on framebuffer device nodes: set /dev/fb* group ownership to a restricted group and remove world access.
- Restrict write access to /sys/class/graphics/fb*/ attributes through udev rules or mandatory access control (SELinux, AppArmor) policies.
- On systems that do not require dynamic framebuffer reconfiguration, blacklist unused framebuffer drivers to reduce the attack surface.
# Example udev rule to restrict framebuffer device access
# /etc/udev/rules.d/60-fbdev-restrict.rules
KERNEL=="fb[0-9]*", MODE="0660", GROUP="video"
# Example: verify running kernel includes the fix commits
zcat /proc/config.gz | grep -i framebuffer
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
