CVE-2026-80579

A flaw was found in the Linux kernel's fbdev component. A local user could exploit a use-after-free vulnerability by manipulating video modes. When a mode is deleted, the fbinfo-mode pointer might not be cleared, leading to a stale pointer dereference during subsequent system file system sysfs...

CVE-2026-80578

A flaw was found in the Linux kernel's fbdev core. A local user could trigger an out-of-bounds read vulnerability in the fbioread function. This occurs due to a pointer desynchronization when handling partial copies from a faulty user buffer, allowing the system to read beyond intended memory...

CVE-2026-80580

A flaw was found in the fbdev component of the Linux kernel. This vulnerability arises because the modestring function, when generating output for the sysfs interface, can write more data than its allocated buffer can hold. An attacker could exploit this by providing a specially crafted input,...

EUVD-2026-66495

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulates the return value into i without checking whether i has reached...

EUVD-2026-66494

In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fbinfo-mode before deleting a videomode fbsetvar can delete a mode from info-modelist when userspace passes FBACTIVATEINVMODE through FBIOPUTVSCREENINFO. The code checks that the mode being deleted is not the current...

EUVD-2026-66493

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fbioread In fbioread, if copytouser performs a partial copy e.g., due to a faulty user buffer, the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the...

AZL-97716 CVE-2026-80579 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fbinfo-mode before deleting a videomode fbsetvar can delete a mode from info-modelist when userspace passes FBACTIVATEINVMODE through FBIOPUTVSCREENINFO. The code checks that the mode being deleted is not the current...

AZL-97809 CVE-2026-80580 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulates the return value into i without checking whether i has reached...

CVE-2026-80580

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulates the return value into i without checking whether i has reached...

CVE-2026-80579

In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fbinfo-mode before deleting a videomode fbsetvar can delete a mode from info-modelist when userspace passes FBACTIVATEINVMODE through FBIOPUTVSCREENINFO. The code checks that the mode being deleted is not the current...

CVE-2026-80578

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fbioread In fbioread, if copytouser performs a partial copy e.g., due to a faulty user buffer, the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the...

AZL-97719 CVE-2026-80578 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fbioread In fbioread, if copytouser performs a partial copy e.g., due to a faulty user buffer, the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the...

CVE-2026-80579

CVE-2026-80579 affects the Linux kernel fbdev subsystem. When userspace triggers deletion of a videomode via FBIOPUT_VSCREENINFO with FB_ACTIVATE_INV_MODE, the function fb_set_var() removes the entry from info->modelist without checking whether fb_info->mode still references it. If the free...

CVE-2026-80580 fbdev: bound mode sysfs output to the sysfs buffer

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulates the return value into i without checking whether i has reached...

CVE-2026-80580 fbdev: bound mode sysfs output to the sysfs buffer

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulates the return value into i without checking whether i has reached...

CVE-2026-80580

CVE-2026-80580 is a buffer overflow in the Linux kernel fbdev subsystem. The function mode_string() uses snprintf(), which can return a value larger than the remaining buffer space. show_modes() accumulates this return value without checking whether the offset has reached PAGE_SIZE , allowing the...

CVE-2026-80579 fbdev: clear fb_info->mode before deleting a videomode

In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fbinfo-mode before deleting a videomode fbsetvar can delete a mode from info-modelist when userspace passes FBACTIVATEINVMODE through FBIOPUTVSCREENINFO. The code checks that the mode being deleted is not the current...

CVE-2026-80578

CVE-2026-80578 affects the Linux kernel's fbdev (framebuffer device) subsystem , specifically the fb_io_read() function in the fbdev core. The root cause is a pointer desynchronization : when copy_to_user() performs a partial copy, the hardware src pointer has already been advanced by the full ch...

CVE-2026-80578 fbdev: core: Fix pointer desynchronization in fb_io_read()

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fbioread In fbioread, if copytouser performs a partial copy e.g., due to a faulty user buffer, the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the...

CVE-2026-80578 fbdev: core: Fix pointer desynchronization in fb_io_read()

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fbioread In fbioread, if copytouser performs a partial copy e.g., due to a faulty user buffer, the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the...