CVE-2026-80578

A flaw was found in the Linux kernel's fbdev core. A local user could trigger an out-of-bounds read vulnerability in the fb_io_read() function. This occurs due to a pointer desynchronization when handling partial copies from a faulty user buffer, allowing the system to read beyond intended memory boundaries. This could lead to information disclosure or system instability.

A flaw with moderate impact was found in the Linux kernel's fbdev core. In fb_io_read(), when copy_to_user() performs a partial copy, for example into a faulty user buffer, the remaining byte count is decremented only by the bytes successfully copied, while the hardware source pointer has already been advanced by the original chunk size. If the loop continues after such a partial copy, this pointer desynchronization causes subsequent iterations to perform framebuffer I/O reads beyond the originally bounded range, resulting in out-of-bounds reads. A local user with permission to read the framebuffer device could exploit this to cause limited information disclosure or system instability, including a kernel panic; there is no network-based attack vector.

Red Hat Enterprise Linux 9 streams from 9.4 onward, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2 are affected, while Red Hat Enterprise Linux 6, 7, and 8, and the RHEL 9.2 stream, are not affected because the vulnerable code is not present in those kernels. For the affected products the fix is currently deferred, so no fix is planned for the current update streams; the residual risk is limited to local denial of service or limited information disclosure by a user who already has local access and permission to read the framebuffer device, with no privilege escalation or write primitive demonstrated.

Red Hat rates this flaw as moderate severity (CVSS 3.1 base score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the CVE.org score of 7.3 (important). This difference reflects Red Hat's assessment that exploitation requires local access with framebuffer device read permissions and that the practical impact is primarily availability (system instability or kernel panic), with no demonstrated path to significant confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.