CVE-2026-80741

drm/log: Fix out-of-bounds read on empty message length

State: Published
Severity: 7.1 High
Published: Sep 3, 2026
Updated: Sep 4, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/log: Fix out-of-bounds read on empty message length

drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINT_MAX, causing an out-of-bounds read.

Add an early return when len is 0.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	25e2c2a3eff55683bbe77b108db2a7e389246666 to before 16a2716910ecf7d31bf3c033ee7c506a0b00b2eeAffected 25e2c2a3eff55683bbe77b108db2a7e389246666 to before 16bcea56f4205314ec2aa04a7ec74e5261d253c7Affected 25e2c2a3eff55683bbe77b108db2a7e389246666 to before 60baa179ed1333535f6e2da4133511db55278ee4Affected
LinuxLinux	6.14Affected before 6.14Not affected 6.18.46 through 6.18.Not affected 7.1.10 through 7.1.Not affected 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.