CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode
In the Linux kernel, the following vulnerability has been resolved:
fbdev: clear fbinfo->mode before deleting a videomode
fbsetvar() can delete a mode from info->modelist when userspace passes FBACTIVATEINVMODE through FBIOPUTVSCREENINFO. The code checks that the mode being deleted is not the current info->var and that fbcon is not using it, but it does not check fbinfo->mode.
fbinfo->mode may still point into the modelist entry being deleted. If the entry is freed, later mode sysfs reads through showmode() can dereference a stale pointer.
Clear fbinfo->mode before calling fbdeletevideomode() when it matches the mode being removed.
Affected Software
Event History
Frequently Asked Questions
What access is needed to trigger the issue?
An attacker needs userspace access capable of issuing FBIOPUT_VSCREENINFO with FB_ACTIVATE_INV_MODE. The vulnerable path is reached when that request causes fb_set_var() to remove a videomode from the framebuffer device's mode list.
When does the stale pointer become reachable?
The deleted mode must still be referenced by fb_info->mode. After the modelist entry is freed, a later sysfs mode read through show_mode() can dereference that stale pointer.
What change resolves the problem?
The fix clears fb_info->mode before fb_delete_videomode() deletes a matching mode. The provided stable references identify the upstream fixes.