CVE-2026-80749 in Linux
Summary
by MITRE • 09/03/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/connector/hdmi: Fix out of bounds memory read
A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 28 byte allocation.
Fix that by using the source size instead, together with a build bug on the source size actually being smaller than the destination.
I hit this running KUnit tests under KASAN (while debugging something else entirely). In the real world, it seems unlikely to cause an actual problem. It is a read not a write so it can't corrupt any memory. However, it could potentially fall off the end of a page and cause an accvio bug.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The Linux kernel's Direct Rendering Manager subsystem contains a critical out-of-bounds memory read vulnerability within its HDMI connector handling logic. This flaw originates in a helper function responsible for copying audio infoframe data into the connector’s internal buffer structure. The core technical error lies in the misuse of size parameters during the copy operation. Specifically, the function utilizes the size of the destination buffer rather than the actual size of the source data block when determining how many bytes to transfer. Since the destination is a generic target designed to accommodate various types of display data blocks, it is allocated with a larger capacity than required for specific audio infoframes. Consequently, the operation attempts to copy approximately sixty bytes from a source allocation that only contains twenty-eight bytes of valid data. This discrepancy results in reading memory beyond the bounds of the intended source object.
From a security and stability perspective, this vulnerability is classified as an out-of-bounds read, which aligns with CWE-125 specifications regarding improper limit enforcement during buffer access operations. While the immediate impact involves accessing uninitialized or unrelated kernel memory, the severity is mitigated by the fact that it constitutes a read-only operation rather than a write. Therefore, direct memory corruption of other structures is not possible through this specific flaw alone. However, the potential for system instability remains significant if the out-of-bounds access crosses page boundaries. Such an event could trigger a kernel paging error or general protection fault, leading to a denial of service condition where the affected process or potentially the entire system crashes due to invalid memory access violations detected by hardware protections like KASAN during testing phases.
In terms of threat modeling and operational impact, this vulnerability is primarily relevant in scenarios involving HDMI audio configuration changes or when specific display connectors are enumerated and initialized under stress conditions that trigger rapid infoframe updates. Although real-world exploitation for information disclosure is unlikely due to the ephemeral nature of kernel stack allocations and the lack of a direct mechanism to exfiltrate the read data, the risk of causing system crashes via page faults cannot be entirely dismissed in edge cases involving specific memory layouts or debugging configurations like KASAN enabled environments. The vulnerability does not appear to provide a path for privilege escalation but represents a stability issue that could affect availability during display mode changes or audio stream setup procedures within the DRM subsystem.
To mitigate this risk, developers must ensure that buffer copy operations strictly adhere to the size of the source data rather than relying on destination capacity assumptions. The fix involves correcting the length parameter passed to the memory copy function to reflect the actual byte count of the audio infoframe structure. Additionally, build-time checks should be implemented or verified to confirm that source sizes are consistently smaller than or equal to their corresponding destinations for all supported data block types. For system administrators and users, applying kernel updates that include this patch is essential to maintain stability in environments where HDMI output with active audio streams is frequently utilized. Regularly updating the Linux kernel ensures that such logic errors in display driver components are resolved before they can potentially lead to unexpected system halts or debugging overheads during routine operations.