CVE-2026-80578

Status: UPDATED  |  Advisory ID: CVE-2026-80578

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

fbdev: core: Fix pointer desynchronization in fb_io_read()

In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to

a faulty user buffer), the loop adjusts the chunk size 'c' and updates

the remaining 'count'. However, the hardware 'src' pointer has already

been eagerly advanced by the original chunk size.

If the loop is allowed to continue, the read will resume from an

incorrect, over-advanced offset. Since the remaining 'count' was only

decremented by the successful bytes, this desynchronization causes the

next iterations to execute more hardware reads than originally bounded,

eventually leading to out-of-bounds I/O reads.

Fix this by breaking out of the loop immediately upon a partial

copy_to_user(). A partial copy indicates a faulty user buffer, making

subsequent read attempts futile. Breaking out ensures we return the

number of successfully read bytes without risking out-of-bounds hardware

accesses in subsequent mismatched iterations. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References