Use-after-free in Linux kernel - CVE-2026-80785

Vulnerability details

The vulnerability allows a local user to store a stale pointer to freed memory in fb_info->mode.

The vulnerability exists due to a use-after-free race condition in the fbdev mode sysfs handlers in drivers/video/fbdev/core/fbsysfs.c when concurrently accessing mode sysfs attributes while the modelist is replaced. A local user can race mode sysfs reads or writes with modelist replacement to store a stale pointer to freed memory in fb_info->mode.

Affected software

How to mitigate CVE-2026-80785

External References

• https://git.kernel.org/stable/c/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2
• https://git.kernel.org/stable/c/26135631ed8e487bc6aef70cc41934e258d09bbe

Related Security Bulletins

• Use-after-free in Linux kernel fbdev core driver