---
id: CVE-2026-80579
title: 'fbdev: clear fb_info->mode before deleting a videomode'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fbdev: clear fb_info->mode before deleting a videomode

  fb_set_var() can delete a mode from info->modelist when userspace
  passes FB_ACTIVATE_INV_MODE through FBIOPUT_VS…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    ce7fef961c63229b22dec415fb988899f479d61f
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    95e647d2a5304a8fd11f1ba3c8502de700650131
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:17:46.592165Z'
published: '2026-08-26'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:26:28.024Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80579'
references:
  - url: 'https://git.kernel.org/stable/c/ce7fef961c63229b22dec415fb988899f479d61f'
  - url: 'https://git.kernel.org/stable/c/95e647d2a5304a8fd11f1ba3c8502de700650131'
tags:
  - cve.org
epss: 0.00165
epssPercentile: 0.05348
ingestedAt: '2026-10-16T19:46:24.312Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fbdev: clear fb_info->mode before deleting a videomode

fb_set_var() can delete a mode from info->modelist when userspace
passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code
checks that the mode being deleted is not the current info->var and
that fbcon is not using it, but it does not check fb_info->mode.

fb_info->mode may still point into the modelist entry being deleted.
If the entry is freed, later mode sysfs reads through show_mode() can
dereference a stale pointer.

Clear fb_info->mode before calling fb_delete_videomode() when it
matches the mode being removed.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ce7fef961c63229b22dec415fb988899f479d61f`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 95e647d2a5304a8fd11f1ba3c8502de700650131`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.