CVE-2026-80578: fbdev: core: Fix pointer desynchronization in fb_io_read()
fbdev: core: Fix pointer desynchronization in fbioread()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What condition is required to trigger the out-of-bounds I/O reads?
A read through fb_io_read() must encounter a partial copy_to_user(), such as when the calling process supplies a faulty user-space buffer. The vulnerable loop then continues despite the hardware source pointer having advanced farther than the successfully copied byte count.
What is the impact of a failed or partial user-buffer copy?
Before the fix, subsequent loop iterations could perform hardware reads beyond the originally bounded range, causing out-of-bounds I/O reads. The fix stops the loop after a partial copy and returns only the number of bytes successfully read.
Are systems affected during normal successful reads?
The described issue depends on a partial copy_to_user() result. The vulnerability path is associated with faulty or otherwise partially writable user buffers during fb_io_read(), rather than fully successful user-buffer copies.