CVE-2026-80579

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the fbdev component where the fb set var() function can delete a mode from the info->modelist when userspace provides FB ACTIVATE INV MODE via FBIOPUT VSCREENINFO. While the system verifies that the mode is not the current info->var and is not in use by fbcon, it fails to check fb info->mode. Consequently, fb info->mode may point to a modelist entry that is being deleted. If this entry is freed, subsequent sysfs reads through the show mode() function can result in a stale pointer dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.