CVE-2026-80578: Linux Kernel fbdev Buffer Overflow Vulnerability

CVE-2026-80578 Overview

CVE-2026-80578 is a Linux kernel vulnerability in the framebuffer device (fbdev) core subsystem. The flaw resides in the fb_io_read() function, where a pointer desynchronization occurs when copy_to_user() performs a partial copy. When the user buffer is faulty and only part of the data is copied, the hardware source pointer advances by the full chunk size while the remaining count decrements only by successfully copied bytes. The loop then continues from an over-advanced offset, resulting in out-of-bounds hardware I/O reads. A local, low-privileged user can trigger this condition to read kernel memory outside the intended boundaries.

Critical Impact
A local user with access to a framebuffer device node can trigger out-of-bounds hardware reads, leading to information disclosure and potential availability impact on the system.

Affected Products

Linux kernel fbdev core subsystem (fb_io_read())
Multiple stable kernel branches, as reflected in the upstream fix commits
Any Linux distribution shipping unpatched kernels with the fbdev core enabled

Discovery Timeline

2026-08-26 - CVE-2026-80578 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80578

Vulnerability Analysis

The vulnerability is an [CWE-125] out-of-bounds read in the Linux kernel framebuffer device core. The fb_io_read() function reads data from a hardware framebuffer region into a user-supplied buffer in chunks. Within its read loop, the function advances the hardware source pointer src by the intended chunk size before invoking copy_to_user(). When copy_to_user() succeeds fully, this bookkeeping is correct. When it fails partially, the two counters diverge.

The loop compensates for the short copy by adjusting the chunk size c and decreasing count only by the number of bytes actually transferred. However, src is not rewound. On the next iteration, the read resumes from a position past the last successfully transferred byte, and the loop can execute more hardware accesses than the original bounds permit. This can cause reads beyond the mapped framebuffer region.

Root Cause

The root cause is inconsistent state management between the hardware read pointer and the user-space transfer counter after a partial copy_to_user(). The function eagerly advances src before verifying the outcome of the user-space copy, breaking the invariant that src and count decrement in lockstep.

Attack Vector

Exploitation requires local access with permission to open a framebuffer device node (typically /dev/fb*). An attacker crafts a read() call using a user buffer designed to cause copy_to_user() to fault partway through, for example by unmapping a page mid-buffer. The kernel then continues iterating with a desynchronized src pointer, issuing out-of-bounds hardware I/O reads. No user interaction is required. See the upstream fix in Linux Kernel Commit 42a6d81 for the exact patched loop logic.

No public proof-of-concept has been published for this issue at the time of writing.

Detection Methods for CVE-2026-80578

Indicators of Compromise

Unexpected kernel oops, page faults, or MCE events referencing fb_io_read in dmesg or /var/log/kern.log.
Processes with no legitimate need for graphics I/O opening /dev/fb* device nodes.
Repeated read() syscalls against framebuffer devices that return short byte counts followed by segmentation faults or EFAULT.

Detection Strategies

Audit access to framebuffer devices using auditd rules on /dev/fb0 and related nodes, then correlate opens with the invoking process lineage.
Monitor kernel ring buffer messages for stack traces containing fb_io_read or fbdev driver symbols, which may indicate exploitation attempts.
Use eBPF-based tracing to observe read() syscalls targeting framebuffer file descriptors combined with abnormal user-buffer memory layouts.

Monitoring Recommendations

Forward kernel logs and audit events to a centralized logging or SIEM platform for retention and correlation across hosts.
Baseline which service accounts and users legitimately access /dev/fb* and alert on deviations.
Track kernel version inventory across the fleet to confirm patch coverage after distribution updates land.

How to Mitigate CVE-2026-80578

Immediate Actions Required

Apply the vendor kernel update from your Linux distribution that incorporates the upstream fbdev fix.
Restrict access to /dev/fb* nodes so that only trusted users and services can open framebuffer devices.
Reboot affected systems after patching to load the corrected kernel image.

Patch Information

The issue is fixed upstream in the Linux kernel. Refer to the following commits across stable branches: Linux Kernel Commit 42a6d81, Linux Kernel Commit 42bc07b, Linux Kernel Commit 7110b7b, Linux Kernel Commit 7ff87a0, and Linux Kernel Commit 81cc73b. The fix breaks out of the read loop as soon as copy_to_user() returns a partial result, avoiding further hardware reads on a desynchronized pointer.

Workarounds

Tighten Discretionary Access Control (DAC) permissions on /dev/fb* and remove membership in the video group for accounts that do not require it.
Blacklist or unload framebuffer drivers on servers that do not need console graphics using modprobe configuration.
Apply Mandatory Access Control (MAC) policies (SELinux, AppArmor) to confine processes that must access framebuffer devices.

bash

# Restrict framebuffer device access to root and the video group only
sudo chown root:video /dev/fb0
sudo chmod 0660 /dev/fb0

# Optionally blacklist framebuffer drivers on headless systems
echo "blacklist fbcon" | sudo tee /etc/modprobe.d/disable-fbdev.conf

# Verify running kernel version after patching
uname -r