CVE-2026-80579

A moderate use-after-free flaw was found in the Linux kernel's fbdev subsystem, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10 update streams and in Red Hat In-Vehicle OS 2. A local user with access to a framebuffer device could pass FB_ACTIVATE_INV_MODE through the FBIOPUT_VSCREENINFO ioctl to delete a video mode from the framebuffer mode list. The code did not verify whether fb_info->mode still pointed at the entry being deleted, so after the entry was freed, a subsequent read of the mode sysfs attribute (show_mode()) could dereference the stale pointer, causing a kernel use-after-free and resulting in a denial of service. For the affected streams the fix is currently deferred: the issue is a local denial of service with no demonstrated confidentiality or integrity impact, so the residual risk is limited to availability on systems where untrusted local users can access framebuffer ioctls. Red Hat Enterprise Linux 6 and 7 (kernel and kernel-rt) are not affected because the vulnerable code is not present in those releases. Red Hat rates this flaw Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the upstream CVE record scores it 7.8 assuming high confidentiality and integrity impacts; Red Hat's rating reflects that the established consequence is a denial of service only.