EUVD-2026-66493
GHSA-fvfx-mw36-f75m
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Local vector because /dev/fb0 access is required; PR:L as non-root account with device read permission suffices; high C and A from unbounded hardware memory reads; low I as no direct write path.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
fbdev: core: Fix pointer desynchronization in fb_io_read()
In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to a faulty user buffer), the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the hardware 'src' pointer has already been eagerly advanced by the original chunk size.
If the loop is allowed to continue, the read will resume from an incorrect, over-advanced offset. Since the remaining 'count' was only decremented by the successful bytes, this desynchronization causes the next iterations to execute more hardware reads than originally bounded, eventually leading to out-of-bounds I/O reads.
Fix this by breaking out of the loop immediately upon a partial copy_to_user(). A partial copy indicates a faulty user buffer, making subsequent read attempts futile. Breaking out ensures we return the number of successfully read bytes without risking out-of-bounds hardware accesses in subsequent mismatched iterations.
AnalysisAI
Out-of-bounds hardware I/O reads in the Linux kernel's fbdev framebuffer subsystem allow low-privileged local users to read memory beyond valid hardware bounds, with high confidentiality and availability impact. The flaw in fb_io_read() stems from pointer desynchronization after a partial copy_to_user() transfer: the hardware source pointer advances by the full original chunk size while count is only decremented by successfully copied bytes, causing subsequent loop iterations to read from incorrect, over-advanced offsets. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local authenticated account with read permission on a framebuffer device node (typically /dev/fb0, governed by group 'video' membership or equivalent udev rules). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H, score 7.3) correctly characterizes this as a local, low-complexity, low-privilege vulnerability - the attack surface is meaningfully narrower than network-exploitable kernel flaws. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local authenticated user with read access to /dev/fb0 allocates a user-space buffer backed by a memory-mapped region engineered to fault partway through a transfer, then calls read() on the framebuffer device. The partial copy_to_user() response desynchronizes the hardware src pointer, causing subsequent loop iterations to read hardware I/O memory beyond the originally requested bounds, potentially leaking framebuffer-adjacent hardware memory contents or triggering a kernel crash. … |
| Remediation | The primary fix is upgrading to a patched kernel version: 6.6.153+ for systems on the 6.6 LTS branch, 6.12.105+ for 6.12 LTS, 6.18.46+ for 6.18, 7.1.10+ for 7.1, or 7.2+ for mainline. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all systems running vulnerable Linux kernel versions, focusing on production infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today