CVE-2026-80785

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: serialize mode sysfs access with lock_fb_info()

show_mode(), show_modes(), and store_mode() access fb_info->modelist

and fb_info->mode without holding lock_fb_info(). store_modes() takes

lock_fb_info() while replacing the modelist and freeing the old one.

A concurrent reader or writer can load a pointer to an old modelist

entry before store_modes() frees it, then dereference freed memory or

store a stale freed pointer in fb_info->mode.

Take lock_fb_info() in show_mode(), show_modes(), and store_mode() to

serialize with store_modes(). In show_mode(), copy the mode to the

stack and format after dropping the lock. In store_mode(), split

activate() into a _locked variant to avoid double-locking, and hold

the locks for the modelist walk, mode conversion, activation, and

fb_info->mode assignment together.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References