CVE-2026-80786 fbdev: Wrap user-invoked calls to fb_set_var() in helper
A missing state check in the Linux kernel framebuffer driver allows local users to trigger inconsistent display states, potentially causing system instability or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80786?
CVE-2026-80786 is a vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fbdev: Wrap user-invoked calls to fb_set_var() in helper
Handle fbcon during display updates in fb_set_var_from_user(). Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers.
Only the FBIOPUT_VSCREENINFO ioctl currently does all steps. Other mode-changes callers in sysfs and driver code are missing fbcon-related steps.
With the new helper, ps3fb and sh_mobile_lcdcfb no longer maintain fbcon state themselves.
Which versions are affected by CVE-2026-80786?
How do I fix CVE-2026-80786?
Apply the vendor's patch.
Is CVE-2026-80786 being exploited?
There is no known exploitation of CVE-2026-80786 in the wild and no public exploit code.
Sources
Also known as AZL-99558, BELL-CVE-2026-80786, DEBIAN-CVE-2026-80786, GHSA-p7rm-gj7v-32rv, UBUNTU-CVE-2026-80786.