EUVD-2026-66495
GHSA-28cj-v8rj-mq63
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local read of sysfs by any unprivileged user triggers overrun; full kernel memory impact warrants C:H/I:H/A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
fbdev: bound mode sysfs output to the sysfs buffer
mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough.
Add a size parameter to mode_string() and use scnprintf() to return only the bytes actually written. Add an early return when offset already exceeds the buffer. In show_modes(), stop accumulating once the buffer is full.
AnalysisAI
Out-of-bounds kernel memory write in the Linux framebuffer device (fbdev) subsystem exposes systems to potential privilege escalation by local low-privileged users. The flaw resides in show_modes(), which accumulates unchecked snprintf() return values while building sysfs output, allowing the write offset to advance beyond the PAGE_SIZE sysfs buffer when a display device has a sufficiently long modelist. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local shell account with at least unprivileged (low-privilege) user access - confirmed by CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local exploitation scenario: an attacker with a shell and low-privilege access triggers the overrun by reading the sysfs modes attribute, and the high C/I/A ratings are consistent with a kernel memory corruption primitive that could enable privilege escalation or system crash. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with a standard shell account on a system with an active framebuffer device reads /sys/class/graphics/fb0/modes on a display device configured with a large number of video modes, triggering show_modes() to overflow the sysfs PAGE_SIZE buffer and write into adjacent kernel memory. If the corruption is controllable, the attacker escalates to root; if not, the kernel panics and the system crashes. … |
| Remediation | The primary remediation is upgrading to Linux kernel 7.1.10 or 7.2, which incorporate the upstream fix commits available at https://git.kernel.org/stable/c/873a1aa15c313263f2e18b38cf525623cc4fabf6 and https://git.kernel.org/stable/c/d15d51fb26e830af58f3f21964f1c09c239077ea. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory Linux systems with framebuffer device (fbdev) drivers in use and identify those running kernels prior to version 7.1.10 or 7.2. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today