CVE-2026-80578

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: core: Fix pointer desynchronization in fb_io_read()

In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to

a faulty user buffer), the loop adjusts the chunk size 'c' and updates

the remaining 'count'. However, the hardware 'src' pointer has already

been eagerly advanced by the original chunk size.

If the loop is allowed to continue, the read will resume from an

incorrect, over-advanced offset. Since the remaining 'count' was only

decremented by the successful bytes, this desynchronization causes the

next iterations to execute more hardware reads than originally bounded,

eventually leading to out-of-bounds I/O reads.

Fix this by breaking out of the loop immediately upon a partial

copy_to_user(). A partial copy indicates a faulty user buffer, making

subsequent read attempts futile. Breaking out ensures we return the

number of successfully read bytes without risking out-of-bounds hardware

acce

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References