CVE-2026-80785

In the Linux kernel, the following vulnerability has been resolved:

fbdev: serialize mode sysfs access with lock fb info()

show mode(), show modes(), and store mode() access fb info->modelist and fb info->mode without holding lock fb info(). store modes() takes lock fb info() while replacing the modelist and freeing the old one.

A concurrent reader or writer can load a pointer to an old modelist entry before store modes() frees it, then dereference freed memory or store a stale freed pointer in fb info->mode.

Take lock fb info() in show mode(), show modes(), and store mode() to serialize with store modes(). In show mode(), copy the mode to the stack and format after dropping the lock. In store mode(), split activate() into a locked variant to avoid double-locking, and hold the locks for the modelist walk, mode conversion, activation, and fb info->mode assignment together.