Look up another CVE · open CVE-2026-80580 in the interactive tracker
CVE-2026-80580
fbdev: bound mode sysfs output to the sysfs buffer
Published 2026-08-26 (2 months ago) by the Linux kernel CNA. Subsystem drivers/video. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-80580 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough. Add a size parameter to mode_string() and use scnprintf() to return only the bytes actually written. Add an early return when offset already exceeds the buffer. In show_modes(), stop accumulating once the buffer is full.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/video/fbdev/core/fbsysfs.c
- What this is
- FRAMEBUFFER COREMAINTAINERS section matched on drivers/video/fbdev/core/ · Odd Fixes
Check it on the machine
grep -wE 'CONFIG_FB|CONFIG_FB_CORE|CONFIG_FB_DEVICE' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormy
- trixie, forky, sidYnot built on s390x/s390x
- y
- built into the kernel image on every flavour - only a patch removes it
- Y
- built in where it is built at all; some flavours do not build it
- Build switches
- CONFIG_FB, CONFIG_FB_CORE, CONFIG_FB_DEVICE
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-26 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.11%, higher than 1.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/video
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.12 | 7.1.10 | 873a1aa15c31 |
| 2.6.12 | 7.2 | d15d51fb26e8 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached only by a local read(2) on /sys/class/graphics/fbN/modes, which flows through sysfs/kernfs into show_modes(); there is no network, adjacent-network, or physical-device packet path to this framebuffer sysfs handler.
- AC:LAttack complexity, low
- Once the framebuffer modelist is long enough to fill PAGE_SIZE, snprintf's oversized return value deterministically pushes the offset past the buffer and subsequent writes use a wrapped huge size; an attacker can also grow the list via repeated FBIOPUT_VSCREENINFO or a privileged store_modes write.
- PR:LPrivileges required, low
- The modes sysfs attribute is DEVICE_ATTR_RW with mode 0644, so any unprivileged local user can open and read it without capabilities; only populating an unusually long modelist may require root or membership in the video group for /dev/fb0 ioctl access.
- UI:NUser interaction, none
- Exploitation requires only the attacker reading the modes sysfs file themselves; no separate victim action such as mounting a filesystem or opening a file is needed.
- S:UScope, unchanged
- The overflow corrupts kernel heap memory within the same OS security boundary and can enable local privilege escalation, but it does not cross VM, IOMMU, or sandbox isolation boundaries.
- C:HConfidentiality impact, high
- Writing past the PAGE_SIZE sysfs seq_file buffer is an out-of-bounds kernel heap write; once the offset exceeds PAGE_SIZE the remaining-length underflow gives snprintf an enormous size, corrupting adjacent kmalloc objects and enabling information disclosure.
- I:HIntegrity impact, high
- The unchecked offset advance causes repeated out-of-bounds writes into kernel heap memory beyond the sysfs buffer, a memory-corruption primitive that can be leveraged for arbitrary kernel writes or control-flow hijacking.
- A:HAvailability impact, high
- Corrupting heap objects adjacent to the sysfs read buffer can trigger immediate kernel oops/panic or later crashes when those objects are used, satisfying High availability impact for kernel memory corruption.