CVE-2026-80580 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
fbdev: bound mode sysfs output to the sysfs buffer
mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough.
Add a size parameter to mode_string() and use scnprintf() to return only the bytes actually written. Add an early return when offset already exceeds the buffer. In show_modes(), stop accumulating once the buffer is full.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel framebuffer subsystem contains a critical out-of-bounds write vulnerability within the sysfs interface for display mode configuration, specifically in the show_modes function which handles the output of available video modes to user space. This flaw stems from an improper handling of return values when formatting strings into a fixed-size buffer using snprintf. The core technical issue lies in the fact that snprintf returns the total number of characters that would have been written if the buffer had sufficient space, rather than the actual number of bytes successfully stored. In this specific implementation, the code accumulates these return values into an offset variable without verifying whether the cumulative size has exceeded the allocated PAGE_SIZE limit. Consequently, when a device supports a large list of display modes, the accumulated offset can surpass the boundaries of the sysfs buffer, leading to a heap-based out-of-bounds write that corrupts adjacent kernel memory structures and potentially allows for arbitrary code execution or system instability.
This vulnerability is classified under CWE-120, which denotes Buffer Copy without Checking Size of Input Classic Out-of-Bound Write, as well as CWE-787, an Out-of-bounds Write in a non-volatile memory context due to the kernel heap nature of sysfs buffers. From a threat modeling perspective aligned with MITRE ATT&CK techniques, this flaw facilitates privilege escalation by allowing local attackers to overwrite critical kernel data structures such as function pointers or object headers. By carefully crafting input that triggers multiple mode entries, an attacker can manipulate the memory layout in user space to gain unauthorized access to higher-privilege contexts within the operating system, effectively bypassing standard security controls and gaining root-level control over the affected Linux instance.
The operational impact of this vulnerability is severe, as it affects any system utilizing framebuffer devices with extensive mode lists, which are common in embedded systems, graphics servers, and virtualized environments where multiple display configurations are supported. An unprivileged local user can exploit this flaw to crash the kernel through a denial-of-service condition or, more dangerously, execute arbitrary code by overwriting specific memory locations that control execution flow. The vulnerability persists until the system is rebooted unless patched, making it a persistent risk for servers and long-running embedded devices that are not frequently restarted.
To mitigate this issue, developers have implemented several key changes to enforce strict buffer boundary checks during string formatting operations. First, the mode_string function was modified to accept an explicit size parameter, ensuring that callers can pass the remaining space in the buffer rather than relying on implicit assumptions about available memory. Second, snprintf was replaced with scnprintf, a safer variant that returns only the number of bytes actually written to the buffer, thereby preventing the accumulation of phantom character counts that exceed physical limits. Additionally, an early return mechanism was introduced within show_modes to halt processing immediately if the offset exceeds the buffer capacity, ensuring no further writes occur once the limit is reached. Systems running affected kernel versions must apply these upstream patches and update their kernel packages to eliminate this memory corruption vector and restore secure operation of framebuffer subsystems.