CVE-2026-80741 in Linux
Summary
by MITRE • 09/03/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/log: Fix out-of-bounds read on empty message length
drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing
newline, but len is unsigned int. If len is 0, the subtraction wraps to UINT_MAX, causing an out-of-bounds read.
Add an early return when len is 0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The Linux kernel's DRM logging subsystem contains a critical logic error within the drm_log_draw_kmsg_record function that results in an out-of-bounds memory read under specific conditions. This vulnerability stems from improper handling of unsigned integer arithmetic during string processing operations. Specifically, the code attempts to strip trailing newline characters by accessing the character at index len minus one. While this operation is generally safe for non-empty strings, it fails catastrophically when the message length variable is zero. Because the length variable is declared as an unsigned int, subtracting one from zero does not result in negative one but instead wraps around to UINT_MAX due to standard two's complement arithmetic rules inherent in C programming languages and their underlying hardware architectures.
This integer wraparound leads directly to a severe out-of-bounds read vulnerability classified under CWE-125: Out-of-bounds Read. When the kernel attempts to access memory at an offset corresponding to UINT_MAX relative to the buffer base, it reads from arbitrary or unmapped memory locations outside the intended log message boundaries. In many system configurations, accessing such high-memory addresses will trigger a page fault exception because those virtual address spaces are not mapped into the current process context. This typically results in a kernel panic or an immediate crash of the operating system, effectively causing a denial of service condition for any user or application relying on the DRM subsystem and its associated logging mechanisms.
From a threat modeling perspective, this flaw aligns with ATT&CK technique T1499: Endpoint Denial of Service, as it allows local actors to destabilize the target system through resource exhaustion via crash induction. Although the vulnerability is located in kernel space, exploitation generally requires local access or specific conditions where an empty message can be passed to the logging routine by a privileged process or triggered through complex driver interactions. The impact extends beyond simple availability loss; depending on memory layout and ASLR configurations, such out-of-bounds reads could potentially leak sensitive information from adjacent kernel structures if the read does not immediately fault, although the primary observed effect is system instability.
The resolution involves implementing an explicit validation check at the beginning of the drm_log_draw_kmsg_record function to verify that the message length is greater than zero before performing any array indexing operations. By adding this early return condition, the code prevents the subtraction operation from executing when len equals zero, thereby eliminating the possibility of integer wraparound and subsequent out-of-bounds access. This fix adheres to secure coding standards by ensuring defensive programming practices are applied to all pointer arithmetic involving user-controlled or dynamically determined lengths. System administrators should apply kernel updates that include this patch immediately to restore system stability and prevent potential denial of service attacks targeting the DRM logging infrastructure.