Executive brief
The Linux kernel's framebuffer device driver contains a logic error in the fb_io_read() function that can cause out-of-bounds hardware memory reads. When a user-space application requests to read framebuffer data and the data copy fails partway through, the driver's internal pointer becomes desynchronized from the amount of data actually read, leading to additional unintended memory accesses. An attacker with local access could exploit this to leak kernel memory or cause system instability.
Technical details
The vulnerability is a pointer desynchronization bug in the fbdev core's fb_io_read() function (drivers/video/fbdev/core/fb_io_fops.c). When copy_to_user() performs a partial copy due to a faulty user buffer, the loop adjusts the chunk size and remaining count, but the hardware source pointer has already been advanced by the original chunk size. If the loop continues, the read resumes from an over-advanced offset, causing out-of-bounds I/O reads. The fix breaks out of the loop immediately upon detecting a partial copy. The vulnerability affects all Linux kernel versions with the fbdev code path and requires local access to trigger; no network attack vector exists.
Affected products
- Linux Linux kernel 2.6.11 through 7.2 (all versions with fbdev module)
Timeline
- 2026-08-26: disclosed: Published on NVD
- 2026-07-21: patched: Patch committed by Mingyu Wang, merged into stable by Greg Kroah-Hartman on 2026-08-23