CVE-2026-80786: fbdev: Wrap user-invoked calls to fb_set_var() in helper
In the Linux kernel, the following vulnerability has been resolved:
fbdev: Wrap user-invoked calls to fbsetvar() in helper
Handle fbcon during display updates in fbsetvarfromuser(). Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers.
Only the FBIOPUTVSCREENINFO ioctl currently does all steps. Other mode-changes callers in sysfs and driver code are missing fbcon-related steps.
With the new helper, ps3fb and shmobilelcdcfb no longer maintain fbcon state themselves.
Affected Software
Event History
Frequently Asked Questions
Which interfaces are implicated beyond the existing ioctl path?
The issue concerns mode-change callers in sysfs and driver code. The FBIOPUT_VSCREENINFO ioctl is identified as the only path that already performs all required fbcon-related steps.
What is required to trigger the affected behavior?
A mode change must be initiated through a user-invoked path that reaches fb_set_var(), including the identified sysfs-related callers. The provided information does not specify required privileges or a remote attack vector.
What changes does the fix make?
The fix routes user-invoked fb_set_var() calls through fb_set_var_from_user(), which checks whether fbcon permits the mode change, updates hardware state, and then updates fbcon state. It also updates callers and removes separate fbcon-state handling from ps3fb and sh_mobile_lcdcfb.