Executive brief
The Linux kernel's display rendering (DRM) logging system contains a flaw in how it handles very large font scaling values on displays. When scaling is set too aggressively, the system can enter an infinite loop that freezes kernel logging output, preventing administrators from seeing critical system messages during boot or troubleshooting.
Technical details
The vulnerability is a logic error in the DRM log driver's scaling calculation. When the scaled font size exceeds the display dimensions, the calculated rows or columns value becomes zero. A zero columns value causes an infinite loop in drm_log_draw_kmsg_record() because the loop condition never decrements the length counter. The fix adds validation in drm_log_setup_modeset() to detect zero rows or columns, properly clean up allocated buffers, and return an error code to prevent the system from entering the infinite loop state. This addresses a regression introduced when integer scaling support was added to the DRM log subsystem.
Affected products
- Linux Linux kernel affected versions include kernels from 2.6.11 through 6.x (specific version range not precisely delimited in advisory)
Timeline
- 2026-09-03: disclosed