CVE-2026-80578

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fbdev: core: Fix pointer desynchronization in fb_io_read()<br /> <br /> In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to<br /> a faulty user buffer), the loop adjusts the chunk size &amp;#39;c&amp;#39; and updates<br /> the remaining &amp;#39;count&amp;#39;. However, the hardware &amp;#39;src&amp;#39; pointer has already<br /> been eagerly advanced by the original chunk size.<br /> <br /> If the loop is allowed to continue, the read will resume from an<br /> incorrect, over-advanced offset. Since the remaining &amp;#39;count&amp;#39; was only<br /> decremented by the successful bytes, this desynchronization causes the<br /> next iterations to execute more hardware reads than originally bounded,<br /> eventually leading to out-of-bounds I/O reads.<br /> <br /> Fix this by breaking out of the loop immediately upon a partial<br /> copy_to_user(). A partial copy indicates a faulty user buffer, making<br /> subsequent read attempts futile. Breaking out ensures we return the<br /> number of successfully read bytes without risking out-of-bounds hardware<br /> accesses in subsequent mismatched iterations.