What is the CVSS score of EUVD-2026-66494?

EUVD-2026-66494 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Linux Kernel fbdev are affected by EUVD-2026-66494?

CVE-2026-80579 is a privilege escalation vulnerability in the Linux kernel that affects any organization running vulnerable kernel versions on systems where users can access framebuffer interfaces.. A patch is available.

How to fix or mitigate EUVD-2026-66494?

Within 24 hours: Identify and inventory all Linux systems running vulnerable kernel versions, focusing on those with user-accessible framebuffer drivers or where standard user accounts exist. Within 7 days: Obtain and test the vendor-released patch against affected kernel versions in a staging environment; prioritize testing on systems with the highest user population or data sensitivity. Within 30 days: Deploy the patch to all affected production systems using your standard change management and update procedures; verify successful patch installation through kernel version verification and confirm no unauthorized privilege escalation vectors remain accessible to standard users.

Linux Kernel fbdev EUVD-2026-66494

| CVE-2026-80579 HIGH

2026-08-26 Linux

GHSA-ppqm-p5h9-4x92

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local ioctl access requires low-privilege account (PR:L/AV:L); no interaction needed; use-after-free enables full kernel memory read/write impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 27, 2026 - 07:08 vuln.today

CVSS changed

Aug 27, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 26, 2026 - 16:17 EUVD

CVE Published

Aug 26, 2026 - 14:37 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 26, 2026 - 14:37 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fbdev: clear fb_info->mode before deleting a videomode

fb_set_var() can delete a mode from info->modelist when userspace passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code checks that the mode being deleted is not the current info->var and that fbcon is not using it, but it does not check fb_info->mode.

fb_info->mode may still point into the modelist entry being deleted. If the entry is freed, later mode sysfs reads through show_mode() can dereference a stale pointer.

Clear fb_info->mode before calling fb_delete_videomode() when it matches the mode being removed.

AnalysisAI

Use-after-free in the Linux kernel's fbdev framebuffer subsystem allows a local low-privileged user to trigger a stale pointer dereference with potential for information disclosure, memory corruption, or privilege escalation. When userspace issues FBIOPUT_VSCREENINFO with FB_ACTIVATE_INV_MODE via the fb_set_var() path, a videomode entry may be deleted from the modelist while fb_info->mode still holds a dangling pointer to the freed entry; a subsequent sysfs read via show_mode() then dereferences freed kernel memory. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain local low-privilege shell

Delivery

Open /dev/fb0 framebuffer device

Exploit

Issue FBIOPUT_VSCREENINFO ioctl with FB_ACTIVATE_INV_MODE

Install

Trigger modelist entry deletion leaving stale fb_info->mode pointer

Read /sys/class/graphics/fb0/mode via sysfs

Execute

Dereference freed kernel heap memory

Impact

Leak kernel data or achieve privilege escalation

Recon

Obtain local low-privilege shell

Delivery

Open /dev/fb0 framebuffer device

Exploit

Issue FBIOPUT_VSCREENINFO ioctl with FB_ACTIVATE_INV_MODE

Install

Trigger modelist entry deletion leaving stale fb_info->mode pointer

Read /sys/class/graphics/fb0/mode via sysfs

Execute

Dereference freed kernel heap memory

Impact

Leak kernel data or achieve privilege escalation

Vulnerability AssessmentAI

Exploitation	Exploitation requires: (1) a local shell account on the target system with read-write access to the framebuffer device node (/dev/fb0 or similar), which typically requires membership in the 'video' group or equivalent; (2) the fbdev subsystem must be loaded and an active framebuffer device present - this excludes pure DRM/KMS systems without legacy fbdev emulation, headless servers, and most container environments; (3) the attacker must issue FBIOPUT_VSCREENINFO with FB_ACTIVATE_INV_MODE targeting a videomode that currently matches fb_info->mode (the mode must be present in the modelist and set as the cached mode pointer); (4) a sysfs read of the framebuffer mode attribute must occur after the deletion, either by the attacker or via a race with another process. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local exploitation vector with low attack complexity and low-privilege requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local user with a standard shell account on a Linux system exposing /dev/fb0 opens the framebuffer device and issues an FBIOPUT_VSCREENINFO ioctl call with FB_ACTIVATE_INV_MODE set, specifying a videomode that matches the currently cached fb_info->mode pointer. The kernel deletes the modelist entry and frees the associated memory without clearing the stale fb_info->mode reference. …
Remediation	The primary fix is to upgrade to Linux kernel 7.2 or Linux 7.1.10, which contain the corrected fb_set_var() logic that clears fb_info->mode before invoking fb_delete_videomode() when a match is detected. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify and inventory all Linux systems running vulnerable kernel versions, focusing on those with user-accessible framebuffer drivers or where standard user accounts exist. …

Threat intelligence, references, and detailed analysis are available after sign-in.