Description

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough. Add a size parameter to mode_string() and use scnprintf() to return only the bytes actually written. Add an early return when offset already exceeds the buffer. In show_modes(), stop accumulating once the buffer is full.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:17:14.103Z",
  "pubdate": "2026-08-26T15:17:14.103Z",
  "executiveSummary": "A buffer overflow vulnerability exists in the Linux kernel fbdev subsystem's sysfs interface for modelist output.\nThe vulnerability stems from improper bounds checking during the string concatenation process in the show_modes() function, leading to potential out-of-bounds memory access.\nThis flaw affects systems utilizing the fbdev driver framework to expose display mode information via sysfs.\nAn unprivileged local attacker could potentially leverage this vulnerability to cause a kernel-level memory corruption, leading to a system crash (Denial of Service) or potentially arbitrary code execution depending on the state of the kernel memory adjacent to the buffer.\nSuccessful exploitation requires local access to the system and the ability to interact with the sysfs filesystem interface associated with the framebuffer device.\nThe risk is mitigated by the fact that the interaction is localized to the sysfs interface, but the integrity of the kernel memory remains a significant concern.",
  "technicalDetails": "The root cause of this vulnerability is an integer overflow and lack of bounds validation within the show_modes() function when interacting with the mode_string() helper. The function mode_string() uses snprintf() to format display modes; however, snprintf() returns the total length of the string that would have been written if space were sufficient, rather than the number of bytes actually written to the buffer.\nIn the vulnerable implementation of show_modes(), the return value of snprintf() is directly accumulated into the offset variable 'i'. If the mode list is sufficiently long, the value of 'i' can exceed the PAGE_SIZE limit of the sysfs buffer. Because the logic fails to verify if 'i' has reached the PAGE_SIZE boundary before proceeding to the next iteration or before appending further data, the subsequent operations perform writes beyond the allocated buffer boundaries.\nThe attack flow involves an adversary triggering the read operation on the sysfs file associated with the framebuffer device modes. By providing a crafted or exhaustive list of display modes, the user triggers the accumulation of string lengths that overflow the PAGE_SIZE buffer. As the offset 'i' advances past the bounds of the allocated buffer, the kernel writes data into adjacent kernel memory areas.\nThis out-of-bounds write primitive allows for the corruption of kernel heap or stack structures, depending on how the sysfs buffer is allocated and managed at the time of the call. The exploitation relies on the inability of the function to perform a safe check (such as using scnprintf() or comparing the offset against the page limit) before modifying the buffer pointer. Because the kernel fails to handle the return value correctly, the logic erroneously proceeds as if it were still writing within the safe confines of the system's memory page.\nImpact includes potential kernel panic via memory corruption or, in more advanced scenarios, the ability for a local attacker to overwrite sensitive kernel function pointers or data structures located near the affected memory region, potentially escalating privileges or causing persistent system instability."
}