CVE-2026-80740
N/A
N/A
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/log: Fix infinite loop when scale is too large for display
When scale is large enough that scaled_font exceeds the display dimensions, rows or columns become 0. A columns value of 0 causes an infinite loop in drm_log_draw_kmsg_record() because the loop never decrements len.
Check for zero rows/columns in drm_log_setup_modeset() and return an error, cleaning up the already allocated buffer to avoid a leak.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 8a4b913df427b8f900bcc7849cc15a7b81628d57 < a7d172b27aa3e1ad56e39949bfe4e5caa25fb20b | affected |
| Linux | Linux | 8a4b913df427b8f900bcc7849cc15a7b81628d57 < 50ca4dbbaf3eb6deb74daca360b4dabc739a6fa6 | affected |
| Linux | Linux | 8a4b913df427b8f900bcc7849cc15a7b81628d57 < f4f2bba28df9b9aaa00262a462139dbbcdc38d9f | affected |
| Linux | Linux | 6.14 | affected |
| Linux | Linux | 0 < 6.14 | unaffected |
| Linux | Linux | 6.18.46 <= 6.18.* | unaffected |
| Linux | Linux | 7.1.10 <= 7.1.* | unaffected |
| Linux | Linux | 7.2 <= * | unaffected |
Weaknesses
References
- https://git.kernel.org/stable/c/a7d172b27aa3e1ad56e39949bfe4e5caa25fb20b
- https://git.kernel.org/stable/c/50ca4dbbaf3eb6deb74daca360b4dabc739a6fa6
- https://git.kernel.org/stable/c/f4f2bba28df9b9aaa00262a462139dbbcdc38d9f
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.