https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 10:46:20 +0000 https://vulnerability.circl.lu/vuln/cve-2026-80578 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>fbdev: core: Fix pointer desynchronization in fb_io_read()</p> <p>In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to a faulty user buffer), the loop adjusts the chunk size &#39;c&#39; and updates the remaining &#39;count&#39;. However, the hardware &#39;src&#39; pointer has already been eagerly advanced by the original chunk size.</p> <p>If the loop is allowed to continue, the read will resume from an incorrect, over-advanced offset. Since the remaining &#39;count&#39; was only decremented by the successful bytes, this desynchronization causes the next iterations to execute more hardware reads than originally bounded, eventually leading to out-of-bounds I/O reads.</p> <p>Fix this by breaking out of the loop immediately upon a partial copy_to_user(). A partial copy indicates a faulty user buffer, making subsequent read attempts futile. Breaking out ensures we return the number of successfully read bytes without risking out-of-bounds hardware accesses in subsequent mismatched iterations.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>fbdev: core: Fix pointer desynchronization in fb_io_read()</p> <p>In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to a faulty user buffer), the loop adjusts the chunk size &#39;c&#39; and updates the remaining &#39;count&#39;. However, the hardware &#39;src&#39; pointer has already been eagerly advanced by the original chunk size.</p> <p>If the loop is allowed to continue, the read will resume from an incorrect, over-advanced offset. Since the remaining &#39;count&#39; was only decremented by the successful bytes, this desynchronization causes the next iterations to execute more hardware reads than originally bounded, eventually leading to out-of-bounds I/O reads.</p> <p>Fix this by breaking out of the loop immediately upon a partial copy_to_user(). A partial copy indicates a faulty user buffer, making subsequent read attempts futile. Breaking out ensures we return the number of successfully read bytes without risking out-of-bounds hardware accesses in subsequent mismatched iterations.</p> https://vulnerability.circl.lu/vuln/cve-2026-80578