Linux Kernel CVE-2026-80578

Exploitation requires a local authenticated account with read permission on a framebuffer device node (typically /dev/fb0, governed by group 'video' membership or equivalent udev rules). The fbdev subsystem must be loaded and a framebuffer device must be present - kernels using only KMS/DRM display drivers without fbdev emulation (CONFIG_FB_CORE disabled or no legacy framebuffer adapter) do not expose this code path. The attacker must be able to craft a user-space buffer that causes copy_to_user() to return a partial count, which requires a deliberately faulting memory region (e.g., memory-mapped with restricted backing). CVSS PR:L confirms a non-root local account is sufficient; PR:N (unauthenticated) does not apply. Systems without physical framebuffer hardware or with framebuffer device access restricted to root are not practically exploitable.

The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H, score 7.3) correctly characterizes this as a local, low-complexity, low-privilege vulnerability - the attack surface is meaningfully narrower than network-exploitable kernel flaws. High confidentiality impact reflects potential disclosure of hardware-mapped memory contents; high availability impact reflects risk of kernel instability from unbounded hardware reads. No EPSS score was provided in the intelligence data, and the absence of a KEV listing and public POC indicates no confirmed widespread exploitation at time of analysis. Practical risk is gated by whether the fbdev subsystem is active and whether the attacker holds local access - cloud and containerized workloads not exposing framebuffer devices are not affected by this code path. The availability of patches across multiple stable branches (6.6.153, 6.12.105, 7.1.10, 7.2, 6.18.46) means remediation is tractable for well-maintained distributions; the primary risk is in distributions or appliances running older LTS kernels with slower patch cadence.

A local authenticated user with read access to /dev/fb0 allocates a user-space buffer backed by a memory-mapped region engineered to fault partway through a transfer, then calls read() on the framebuffer device. The partial copy_to_user() response desynchronizes the hardware src pointer, causing subsequent loop iterations to read hardware I/O memory beyond the originally requested bounds, potentially leaking framebuffer-adjacent hardware memory contents or triggering a kernel crash. No public proof-of-concept code has been identified at time of analysis.