CVE-2026-80741: drm/log: Fix out-of-bounds read on empty message length
In the Linux kernel, the following vulnerability has been resolved:
drm/log: Fix out-of-bounds read on empty message length
drmlogdrawkmsgrecord() accesses s[len - 1] to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINTMAX, causing an out-of-bounds read.
Add an early return when len is 0.
Affected Software
Event History
Frequently Asked Questions
Can exposure be determined from the kernel version alone?
No affected kernel version range is provided. The available references point to stable-kernel fixes, so deployments should compare their kernel source or applied patches with those fixes.
What runtime condition reaches the vulnerable access?
The issue occurs when drm_log_draw_kmsg_record() handles a message whose length is zero. The unsigned length value underflows during len - 1, causing an out-of-bounds read.
What does the available fix change?
The fix adds an early return when the message length is zero, preventing the underflowing index calculation and subsequent read.