CVE-2026-80740: drm/log: Fix infinite loop when scale is too large for display
In the Linux kernel, the following vulnerability has been resolved:
drm/log: Fix infinite loop when scale is too large for display
When scale is large enough that scaledfont exceeds the display dimensions, rows or columns become 0. A columns value of 0 causes an infinite loop in drmlogdrawkmsgrecord() because the loop never decrements len.
Check for zero rows/columns in drmlogsetupmodeset() and return an error, cleaning up the already allocated buffer to avoid a leak.
Affected Software
Event History
Frequently Asked Questions
What condition triggers the hang?
The issue occurs when the configured scale is large enough that the scaled font exceeds the display dimensions, causing the calculated row or column count to become zero. A zero column count can make drm_log_draw_kmsg_record() loop indefinitely because it does not decrement the remaining length.
What happens if the invalid display sizing condition is encountered after the fix?
drm_log_setup_modeset() detects zero rows or columns and returns an error instead of proceeding. It also cleans up the buffer that was already allocated, preventing a memory leak on this error path.