HIGH Introduced in 2.6.12
fbdev ModeString Overflow
CVE-2026-80580
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough. Add a size parameter to mode_string() and use scnprintf() to return only the bytes actually written. Add an early return when offset already exceeds the buffer. In show_modes(), stop accumulating once the buffer is full.
02KernelScan AI Analysis
Risk summary
Any local user on a system with a framebuffer device that has a long enough modelist can trigger a heap buffer overflow by reading the modes sysfs attribute. The overflow corrupts kernel heap memory adjacent to the page-sized sysfs buffer, which can lead to kernel crashes or potential code execution. No special privileges are required to read sysfs.
Vulnerability analysis
When a user reads the framebuffer modes sysfs attribute, the kernel iterates over the device's video mode list and formats each entry into a page-sized buffer. The helper routine used a print function that reports how many characters would have been written rather than how many actually fit, and the caller accumulated this value without checking whether it had already reached the buffer boundary. On a device with enough video modes, the offset advances past the end of the buffer and subsequent writes corrupt adjacent kernel heap memory. The fix switches to a bounded print function that returns only the bytes actually written, adds an explicit bounds check before each write, and stops the loop once the buffer is full. Any local user can trigger this by reading a world-readable sysfs file, but the target framebuffer device must have a sufficiently long list of configured video modes.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.1 | 2.6.12 | 7.1.10 | 873a1aa15c31 |
| mainline | 2.6.12 | 7.2 | d15d51fb26e8 |