CVE-2026-80578: fbdev: core: Fix pointer desynchronization in fb_io_read()
In the Linux kernel, the following vulnerability has been resolved:
fbdev: core: Fix pointer desynchronization in fbioread()
In fbioread(), if copytouser() performs a partial copy (e.g., due to a faulty user buffer), the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the hardware 'src' pointer has already been eagerly advanced by the original chunk size.
If the loop is allowed to continue, the read will resume from an incorrect, over-advanced offset. Since the remaining 'count' was only decremented by the successful bytes, this desynchronization causes the next iterations to execute more hardware reads than originally bounded, eventually leading to out-of-bounds I/O reads.
Fix this by breaking out of the loop immediately upon a partial copytouser(). A partial copy indicates a faulty user buffer, making subsequent read attempts futile. Breaking out ensures we return the number of successfully read bytes without risking out-of-bounds hardware accesses in subsequent mismatched iterations.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the out-of-bounds I/O reads?
A read through fb_io_read() must encounter a partial copy_to_user(), such as when the calling process supplies a faulty user-space buffer. The vulnerable loop then continues despite the hardware source pointer having advanced farther than the successfully copied byte count.
What is the impact of a failed or partial user-buffer copy?
Before the fix, subsequent loop iterations could perform hardware reads beyond the originally bounded range, causing out-of-bounds I/O reads. The fix stops the loop after a partial copy and returns only the number of bytes successfully read.
Are systems affected during normal successful reads?
The described issue depends on a partial copy_to_user() result. The vulnerability path is associated with faulty or otherwise partially writable user buffers during fb_io_read(), rather than fully successful user-buffer copies.