CVE-2026-80741

The Linux kernel's drm/log console driver (used to render kernel log messages on DRM-backed displays) contains an out-of-bounds read in drm_log_draw_kmsg_record(): when a kmsg record has length 0, the unsigned expression s[len - 1] underflows to UINT_MAX and the code reads far past the end of the message buffer. The flaw is triggered by drawing a zero-length kernel log record, which a local user can potentially provoke, and per the CVSS scoring could expose kernel memory (confidentiality impact) or crash the system (availability impact). Systems are affected only if they run a Linux kernel with the drm/log driver present and enabled, and exploitation requires local access with low privileges. Exploitation status: none known — there is no public proof-of-concept, no CISA KEV listing, and EPSS puts the 30-day exploitation probability at only 0.2%.

What to do: Track your distribution's kernel updates for the drm/log fix (the upstream patch adds an early return when the record length is 0) and install the fixed kernel when it is released for your distro. In the meantime, check whether the drm/log driver is compiled in or loaded (e.g., look for drm_log in /proc/kallsyms or loaded modules) and avoid enabling the DRM log console on multi-user systems if it is not required.