In the Linux kernel, the following vulnerability has been resolved:
drm/log: Fix out-of-bounds read on empty message length
drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINT_MAX, causing an out-of-bounds read.
Add an early return when len is 0.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-ibmUpgrade linux-riscv-7.0Upgrade linuxUpgrade linux-riscvUpgrade linux-awsUpgrade linux-oem-7.0Upgrade linux-oracleUpgrade linux-gcpUpgrade linux-hwe-7.0 | Nov 3, 2026 | Sep 3, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub