Pointer Desynchronization Vulnerability in Linux Kernel by Linux Foundation

CVE-2026-80578

What is CVE-2026-80578?

In the Linux kernel, a vulnerability related to pointer desynchronization has been found in the fb_io_read() function within the fbdev subsystem. When a call to copy_to_user() results in a partial copy due to an improper user buffer, the loop continues executing with an incorrectly advanced hardware source pointer. This can lead to excess hardware reads beyond the intended limits, ultimately resulting in out-of-bounds I/O reads. The fix ensures that if a partial copy occurs, the function exits immediately, thereby preventing potential security risks associated with unbound hardware access in subsequent operations.

References