HIGH Introduced in 6.14
drm_log KmsgRecord OOB
CVE-2026-80741
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
KernelScan AI5.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINT_MAX, causing an out-of-bounds read. Add an early return when len is 0.
02KernelScan AI Analysis
Risk summary
An out-of-bounds read occurs in the DRM log client when processing a kernel message record with zero length, due to unsigned integer underflow when computing an array index. The issue can be triggered locally and may cause a kernel panic or denial of service; information disclosure or code execution is unlikely given the read-only nature of the primitive.
Vulnerability analysis
When the DRM log client renders a kernel message record, it unconditionally indexes the message buffer at an offset computed by subtracting one from the record length. Because the length is an unsigned integer, a zero-length record causes the subtraction to wrap to a very large value, producing an out-of-bounds read from kernel memory. The fix adds an early return so that empty records are skipped before any indexing occurs. The vulnerable path is reached locally through the DRM log subsystem, which processes kernel messages for display on attached or virtual DRM devices; no special privileges beyond local access are required to influence the messages that trigger the bug.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.14 | 6.18.46 | 16a2716910ec |
| 7.1 | 6.14 | 7.1.10 | 16bcea56f420 |
| mainline | 6.14 | 7.2 | 60baa179ed13 |