CVE-2026-80740 in Linux
Summary
by MITRE • 09/03/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/log: Fix infinite loop when scale is too large for display
When scale is large enough that scaled_font exceeds the display dimensions, rows or columns become 0. A columns value of 0 causes an infinite loop in drm_log_draw_kmsg_record() because the loop never decrements len.
Check for zero rows/columns in drm_log_setup_modeset() and return an error, cleaning up the already allocated buffer to avoid a leak.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The Linux kernel's Direct Rendering Manager subsystem contains a critical logic flaw within its logging mechanism that can lead to system instability or denial of service conditions under specific display configuration scenarios. This vulnerability resides in the drm_log module, which is responsible for capturing and displaying kernel messages on the screen during boot or error states when standard console output might be unavailable. The core issue arises from an arithmetic operation used to calculate how many rows and columns are required to render a scaled font onto the available display dimensions. When the specified scale factor is excessively large relative to the physical resolution of the connected display, the resulting calculation for either the number of rows or columns results in zero due integer division truncation or similar logical overflow behavior inherent in fixed-point arithmetic implementations common in kernel space drivers.
This mathematical result triggers an infinite loop within the drm_log_draw_kmsg_record function. The rendering routine iterates through the text buffer to draw characters, relying on a length variable that is decremented with each iteration based on the calculated grid dimensions. When one of these dimension values is zero, the decrement operation fails to progress toward the termination condition of the loop. Consequently, the processor remains trapped in this execution path indefinitely, consuming all available CPU cycles allocated to the kernel task and effectively freezing the system. This represents a classic denial of service vector where local access or specific display initialization sequences can cause complete unresponsiveness without requiring elevated privileges if triggered during early boot stages via device tree parameters or bootloader configurations.
From a vulnerability classification perspective, this flaw aligns with CWE-835, which describes loops that do not terminate due to logic errors involving zero divisors or incorrect boundary conditions. It also maps to MITRE ATT&CK techniques related to resource exhaustion and denial of service, specifically within the context of kernel-level execution environments where recovery mechanisms are limited. The lack of input validation for geometric constraints allows an attacker with control over display parameters, such as those passed through device tree overlays in embedded systems or specific DRM driver configurations, to induce this state reliably.
The remediation implemented addresses both the immediate symptom and potential secondary issues like memory leaks. By introducing a check within drm_log_setup_modeset(), the kernel now validates that the calculated rows and columns are greater than zero before proceeding with buffer allocation and rendering setup. If either dimension is found to be zero, indicating an invalid scale-to-resolution ratio, the function returns an error code immediately. Crucially, this early exit includes proper cleanup of any buffers already allocated during the setup phase, preventing memory leaks that could otherwise accumulate over time or across multiple failed attempts. This defensive programming approach ensures system stability by gracefully handling edge cases in display scaling rather than allowing them to cascade into fatal kernel hangs.
System administrators and developers should ensure their kernels are updated with this patch applied, particularly for embedded devices or servers using custom DRM drivers where display parameters might be dynamically adjusted. Mitigation strategies also include reviewing device tree configurations or bootloader arguments that set font scales to reasonable values compatible with the target hardware resolution. Regular auditing of kernel logging subsystems against similar arithmetic boundary conditions is recommended to prevent analogous vulnerabilities in other parts of the graphics stack.