CVE-2026-80749

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80749", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.790Z", "datePublished": "2026-09-03T08:26:30.140Z", "dateUpdated": "2026-09-04T04:58:29.179Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-04T04:58:29.179Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/connector/hdmi: Fix out of bounds memory read\n\nA helper function was copying a given audio infoframe into the\nconnector's copy but using the size of the destination (a generic\ntarget, sized to accept many different data blocks) not the source (a\nvery specific type of data block). Thus, it was copying 60 bytes of\ndata from a 28 byte allocation.\n\nFix that by using the source size instead, together with a build bug\non the source size actually being smaller than the destination.\n\nI hit this running KUnit tests under KASAN (while debugging something\nelse entirely). In the real world, it seems unlikely to cause an\nactual problem. It is a read not a write so it can't corrupt any\nmemory. However, it could potentially fall off the end of a page and\ncause an accvio bug."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only via the ALSA PCM prepare path (SNDRV_PCM_IOCTL_PREPARE) through hdmi-codec into DRM HDMI audio prepare callbacks; it is not reachable from network protocols or remote packet handling.\nAC:L - Any local caller that can prepare HDMI audio reliably hits the faulty memcpy on every invocation; no special memory layout, timing window, or rare kernel configuration is required beyond having a supported HDMI audio driver loaded.\nPR:L - Triggering the path requires only access to ALSA PCM devices (/dev/snd/pcm*) to start HDMI audio playback, which typical unprivileged desktop, mobile, and embedded users already have without real root or init-namespace capabilities.\nUI:N - Exploitation is self-contained: the attacker prepares or starts HDMI audio playback themselves and does not depend on a separate victim performing an additional action beyond normal attacker-controlled playback setup.\nS:U - Impact is confined to kernel memory read and possible local kernel fault within the same privilege domain; it does not cross VM, IOMMU, or sandbox boundaries into another security authority.\nC:H - The vulnerable memcpy reads 60 bytes from a 28-byte hdmi_audio_infoframe, causing a 32-byte out-of-bounds kernel stack read whose contents are copied into connector state; OOB reads are rated High unless strictly limited to a few bytes.\nI:N - This is an out-of-bounds read, not an out-of-bounds write or use-after-free; kernel memory is not corrupted and no arbitrary write or control-flow hijack primitive is created, only mis-sized copying into an intended destination buffer.\nA:H - The over-read can cross a page boundary and fault (as noted by the fix author), producing a kernel oops/access violation; any kernel crash from memory access violations is rated High availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/display/drm_hdmi_state_helper.c"], "versions": [{"version": "f378b77227bc4732922c57f92be89438bb1018a1", "lessThan": "d9f7454c185c0c7f0973e11d62ad6c06862c324c", "status": "affected", "versionType": "git"}, {"version": "f378b77227bc4732922c57f92be89438bb1018a1", "lessThan": "e5b527804a1ea4f70e139179d3062cf5de8c06ab", "status": "affected", "versionType": "git"}, {"version": "f378b77227bc4732922c57f92be89438bb1018a1", "lessThan": "f72bb95732bc5ca87b50c52c8f087ba501950809", "status": "affected", "versionType": "git"}, {"version": "f378b77227bc4732922c57f92be89438bb1018a1", "lessThan": "9ecf8ba763d0ffe0673538eb4bf7806f20455d19", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/display/drm_hdmi_state_helper.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.105", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.46", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.1.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d9f7454c185c0c7f0973e11d62ad6c06862c324c"}, {"url": "https://git.kernel.org/stable/c/e5b527804a1ea4f70e139179d3062cf5de8c06ab"}, {"url": "https://git.kernel.org/stable/c/f72bb95732bc5ca87b50c52c8f087ba501950809"}, {"url": "https://git.kernel.org/stable/c/9ecf8ba763d0ffe0673538eb4bf7806f20455d19"}], "title": "drm/connector/hdmi: Fix out of bounds memory read", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/display/drm_hdmi_state_helper.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d9f7454c185c0c7f0973e11d62ad6c06862c324c", "status": "affected", "version": "f378b77227bc4732922c57f92be89438bb1018a1", "versionType": "git"}, {"lessThan": "e5b527804a1ea4f70e139179d3062cf5de8c06ab", "status": "affected", "version": "f378b77227bc4732922c57f92be89438bb1018a1", "versionType": "git"}, {"lessThan": "f72bb95732bc5ca87b50c52c8f087ba501950809", "status": "affected", "version": "f378b77227bc4732922c57f92be89438bb1018a1", "versionType": "git"}, {"lessThan": "9ecf8ba763d0ffe0673538eb4bf7806f20455d19", "status": "affected", "version": "f378b77227bc4732922c57f92be89438bb1018a1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/display/drm_hdmi_state_helper.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.105", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.46", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/connector/hdmi: Fix out of bounds memory read\n\nA helper function was copying a given audio infoframe into the\nconnector's copy but using the size of the destination (a generic\ntarget, sized to accept many different data blocks) not the source (a\nvery specific type of data block). Thus, it was copying 60 bytes of\ndata from a 28 byte allocation.\n\nFix that by using the source size instead, together with a build bug\non the source size actually being smaller than the destination.\n\nI hit this running KUnit tests under KASAN (while debugging something\nelse entirely). In the real world, it seems unlikely to cause an\nactual problem. It is a read not a write so it can't corrupt any\nmemory. However, it could potentially fall off the end of a page and\ncause an accvio bug."}], "id": "CVE-2026-80749", "lastModified": "2026-09-04T05:17:14.877", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-03T13:06:14.520", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9ecf8ba763d0ffe0673538eb4bf7806f20455d19"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d9f7454c185c0c7f0973e11d62ad6c06862c324c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e5b527804a1ea4f70e139179d3062cf5de8c06ab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f72bb95732bc5ca87b50c52c8f087ba501950809"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f378b77227bc4732922c57f92be89438bb1018a1,d9f7454c185c0c7f0973e11d62ad6c06862c324c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f378b77227bc4732922c57f92be89438bb1018a1,e5b527804a1ea4f70e139179d3062cf5de8c06ab)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f378b77227bc4732922c57f92be89438bb1018a1,f72bb95732bc5ca87b50c52c8f087ba501950809)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f378b77227bc4732922c57f92be89438bb1018a1,9ecf8ba763d0ffe0673538eb4bf7806f20455d19)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.105,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.46,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.10,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-03T13:00:04.830837+00:00", "updated": "2026-09-04T06:30:14.809039+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-119"]}