CVE-2026-80580

A flaw was found in the fbdev component of the Linux kernel. This vulnerability arises because the mode_string() function, when generating output for the sysfs interface, can write more data than its allocated buffer can hold. An attacker could exploit this by providing a specially crafted input, leading to a buffer overflow. This could result in memory corruption, potentially causing system instability or a denial of service.

A moderate impact buffer overflow flaw was found in the fbdev subsystem of the Linux kernel as shipped in Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9. When the sysfs modes attribute of a frame buffer device is read, the mode_string() helper formats each video mode using snprintf(), whose return value can exceed the space remaining in the sysfs buffer, and show_modes() accumulates that return value into its offset without checking whether the offset has already reached PAGE_SIZE. If a frame buffer device exposes a sufficiently long modelist, the offset can advance past the end of the sysfs buffer, resulting in an out-of-bounds write and kernel memory corruption. A local low-privileged user able to read the sysfs modes attribute of such a device could exploit this flaw to crash the kernel, causing a denial of service. Red Hat rated this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the realistic impact is limited to system availability; this differs from the CVEORG score of 7.8, which assumes high confidentiality and integrity impact as well. Red Hat Enterprise Linux 6, 7, and 10 and Red Hat In-Vehicle OS are marked not affected because the vulnerable code is not present in those kernels. For the affected Red Hat Enterprise Linux 8 and 9 kernel and kernel-rt update streams the fix has been deferred because of the moderate severity of the flaw and the limited practical impact; the residual risk is that a local attacker on an affected system with a frame buffer device exposing a long enough modelist could trigger kernel memory corruption and a system crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.