Linux Kernel up to 7.1.10 fbdev show_mode/show_modes/store_mode use after free

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.1.10. It has been declared as very critical. Impacted is the function show_mode/show_modes/store_mode of the component fbdev. The manipulation results in use after free. This vulnerability is cataloged as CVE-2026-80785. The attack must be initiated from a local position. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.1.10. Affected is the function show_mode/show_modes/store_mode of the component fbdev. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: fbdev: serialize mode sysfs access with lock_fb_info() show_mode(), show_modes(), and store_mode() access fb_info->modelist and fb_info->mode without holding lock_fb_info(). store_modes() takes lock_fb_info() while replacing the modelist and freeing the old one. A concurrent reader or writer can load a pointer to an old modelist entry before store_modes() frees it, then dereference freed memory or store a stale freed pointer in fb_info->mode. Take lock_fb_info() in show_mode(), show_modes(), and store_mode() to serialize with store_modes(). In show_mode(), copy the mode to the stack and format after dropping the lock. In store_mode(), split activate() into a _locked variant to avoid double-locking, and hold the locks for the modelist walk, mode conversion, activation, and fb_info->mode assignment together.

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2026-80785 since 08/26/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/04/2026).

Upgrading to version 7.1.11 eliminates this vulnerability. Applying the patch 26135631ed8e487bc6aef70cc41934e258d09bbe/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.1.8
• 7.1.9
• 7.1.10

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion