UBUNTU-CVE-2026-80580: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer modestring() uses snprintf() which can return a value larger than the remaining buffer space. showmodes() accumulates the return value into i without checking whether i has reached PAGESIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough. Add a size parameter to modestring() and use scnprintf() to return only the bytes actually written. Add an early return when offset already exceeds the buffer. In showmodes(), stop accumulating once the buffer is full.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the listed Ubuntu Linux kernel packages are potentially affected. Exploitation requires local access and low privileges; no user interaction is required.
What condition is needed to trigger the flaw?
The framebuffer device mode list must be long enough for show_modes() output to exceed the sysfs PAGE_SIZE buffer. The issue occurs while generating mode information through the fbdev sysfs interface.
What is the potential impact?
A local low-privileged attacker may be able to compromise confidentiality, integrity, and availability, as reflected by the High severity CVSS vector.
How can I tell whether my system is affected?
Check whether the running kernel belongs to one of the listed Ubuntu kernel package families and whether it includes the upstream fix referenced by commit d15d51fb26e830af58f3f21964f1c09c239077ea. The provided data does not identify fixed package versions.