CVE-2026-80580 fbdev: bound mode sysfs output to the sysfs buffer
A buffer overflow in the Linux kernel fbdev sysfs interface can cause a denial of service when displaying long modelists.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80580?
CVE-2026-80580 is a high-severity denial of service vulnerability in Linux, published on 26 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fbdev: bound mode sysfs output to the sysfs buffer
mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough.
Add a size parameter to mode_string() and use scnprintf() to return only the bytes actually written. Add an early return when offset already exceeds the buffer. In show_modes(), stop accumulating once the buffer is full.
Which versions are affected by CVE-2026-80580?
How do I fix CVE-2026-80580?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-80580 being exploited?
There is no known exploitation of CVE-2026-80580 in the wild and no public exploit code.
Sources
Also known as AZL-97809, BELL-CVE-2026-80580, DEBIAN-CVE-2026-80580, GHSA-28cj-v8rj-mq63, UBUNTU-CVE-2026-80580.