Executive brief
The Linux kernel's host1x GPU debugging component contains a buffer handling flaw in its debug output functions. Under specific conditions involving formatted output longer than 256 bytes, this could cause sensitive kernel memory to be read and potentially exposed through debugfs files. This affects only debug operations and is unlikely to occur in normal use.
Technical details
The vulnerability exists in host1x_debug_output() and host1x_debug_cont() functions in drivers/gpu/host1x/debug.c, which used vsnprintf() to format strings into a fixed 256-byte buffer. The issue is that vsnprintf() returns the length of the formatted string as if an unbounded buffer existed, not the actual bytes written. When formatted output exceeded the buffer size, this inflated return value was passed to the output handler, causing a read past the buffer boundary. The vulnerability is exploitable only through debugfs access (typically requiring root or debug permissions) and only affects the debugfs debug sink; the printk sink ignores the byte count. The fix switches to vscnprintf(), which correctly returns only the bytes actually written.
Affected products
- Linux Linux kernel Affected through at least 6.x versions (patch released 2026-09-14)
Timeline
- 2026-06-09: other: Vulnerability fix authored by Mikko Perttunen
- 2026-09-14: patched: Patch merged to stable kernel trees
- 2026-09-17: disclosed: CVE published