CVE-2026-80785

A flaw was found in the fbdev component of the Linux kernel. Improper synchronization during mode sysfs access allows a concurrent reader or writer to access freed memory. This can occur when show_mode(), show_modes(), or store_mode() are called while store_modes() is replacing and freeing the modelist. A successful exploit could lead to a use-after-free condition, potentially resulting in memory corruption and denial of service.

fbdev sysfs mode handling has a race because show_mode, show_modes, and store_mode can access fb_info modelist and fb_info mode without holding lock_fb_info while store_modes can replace the modelist and free the old entries. A local actor who can trigger concurrent mode reads or writes and modelist replacement can cause a reader or writer to dereference freed memory, or store a stale freed mode pointer in fb_info mode. For the CVSS the PR:L is used for the paranoid score because some deployments may expose framebuffer control through delegated device access, reduced capability root, or service accounts rather than full host administrator access. The issue is not network reachable and requires local interaction with fbdev sysfs control paths. Impact is at least local denial of service via kernel crash. In the worst still defensible case, the stale pointer and use-after-free primitive may allow confidentiality or integrity impact and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.