Linux Kernel fbdev EUVD-2026-66495

Exploitation requires a local shell account with at least unprivileged (low-privilege) user access - confirmed by CVSS PR:L. The fbdev subsystem must be loaded and an active framebuffer device (/dev/fb*) must be enumerated by the kernel, which is NOT the default on most modern headless Linux servers. The framebuffer device must have a sufficiently large modelist such that iterating all modes in show_modes() exhausts the PAGE_SIZE (4096-byte) sysfs buffer - this condition is most plausible on virtual machines with many virtual resolutions, embedded display controllers with extensive mode tables, or desktop systems with multi-monitor configurations. Reading the sysfs attribute (e.g., cat /sys/class/graphics/fb0/modes) is the sole trigger; no special permissions beyond filesystem read access to that sysfs path are needed. Limiting factors: the local attack vector (no network exposure), fbdev module must be present and active (absent on most servers and container hosts), and a long enough modelist must exist to overflow the 4096-byte buffer.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local exploitation scenario: an attacker with a shell and low-privilege access triggers the overrun by reading the sysfs modes attribute, and the high C/I/A ratings are consistent with a kernel memory corruption primitive that could enable privilege escalation or system crash. No EPSS data was included in the provided intelligence, preventing probabilistic comparison. The vulnerability is absent from CISA KEV and no POC code has been identified, both of which reduce near-term urgency relative to the raw CVSS score. Practical exploitability is further gated by the need for a framebuffer device with a long enough modelist - a condition more common in desktop workstations, embedded display platforms, and VMs with large virtual resolution sets than in headless production servers where fbdev is typically absent or inactive. The 'Information Disclosure' tag in the provided intelligence understates the severity implied by I:H and A:H in the CVSS vector; the full impact likely extends to kernel memory integrity and availability, not merely disclosure. The absence of KEV listing and POC is confirmed, but the local kernel memory corruption class warrants prioritization during routine kernel update cycles regardless.

A local user with a standard shell account on a system with an active framebuffer device reads /sys/class/graphics/fb0/modes on a display device configured with a large number of video modes, triggering show_modes() to overflow the sysfs PAGE_SIZE buffer and write into adjacent kernel memory. If the corruption is controllable, the attacker escalates to root; if not, the kernel panics and the system crashes. No public POC exists at time of analysis, and exploitation requires the unlikely combination of fbdev presence and an unusually long modelist.