Description

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINT_MAX, causing an out-of-bounds read. Add an early return when len is 0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-03T13:06:13.317Z",
  "pubdate": "2026-09-03T13:06:13.317Z",
  "executiveSummary": "A critical out-of-bounds read vulnerability exists in the Linux kernel within the drm/log component, specifically affecting the drm_log_draw_kmsg_record() function.\nThe vulnerability is triggered by an integer underflow when processing an empty message string, leading to an unauthorized memory access.\nThe flaw allows an attacker capable of triggering kernel message logging to perform an out-of-bounds read operation, potentially exposing sensitive kernel memory contents or causing a kernel panic (Denial of Service).\nThis vulnerability affects the kernel's DRM logging subsystem, and exploitation typically requires local access or the ability to influence kernel log buffer content.\nThe risk is significant due to potential information disclosure and system instability caused by accessing memory outside the intended buffer boundaries.\nNo specific authentication beyond local user access is generally required, provided the attacker can interact with the affected subsystem.",
  "technicalDetails": "The vulnerability resides within the drm_log_draw_kmsg_record() function, which is responsible for processing and formatting kernel log messages for the DRM (Direct Rendering Manager) subsystem.\nThe root cause is an unchecked length parameter (len), which is defined as an unsigned integer (unsigned int). In the logic responsible for stripping trailing newlines from the message string 's', the code attempts to access the character at index 'len - 1'.\nWhen the input message 'len' is 0, the expression 'len - 1' triggers an integer underflow, causing the value to wrap around to UINT_MAX. This resulting index is then used to access the memory address s[UINT_MAX].\nBecause the function fails to validate the length of the string before performing the arithmetic operation, the code proceeds to read memory offset by UINT_MAX relative to the base address of the message buffer 's'. This constitutes a classic out-of-bounds read (OOBR).\nIn terms of attack flow, an attacker who can inject a zero-length message into the kernel log buffer—or otherwise influence the buffer processed by the drm/log component—can trigger the OOBR. Upon execution, the kernel will attempt to read memory at a location significantly outside the allocated memory region for the string buffer.\nThis exploitation can lead to a kernel oops or segmentation fault, resulting in a Denial of Service. Furthermore, if the read value is subsequently exposed through a logging interface or side-channel, it may lead to the disclosure of sensitive kernel memory, such as pointer addresses or credential data, depending on the memory layout adjacent to the buffer.\nThe vulnerable component is identified as the drm/log framework within the Linux kernel. The vulnerability persists in versions where the length check on the message string is absent prior to the index subtraction operation. There are no complex network requirements, as this is a local kernel-space memory corruption vulnerability."
}