Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length… (CVE-2026-80741)

The Linux kernel's drm_log_draw_kmsg_record() function improperly handles the case where the message length (len) is zero. It attempts to access s[len - 1] to remove a trailing newline, but since len is an unsigned integer, subtracting one when len is zero causes an integer wraparound to UINT_MAX, leading to an out-of-bounds read. This vulnerability was fixed by introducing an early return when len is zero to prevent the invalid memory access.

This vulnerability allows a local attacker with limited privileges (PR:L) to cause an out-of-bounds read in kernel memory, potentially leading to a denial of service (system crash) or information disclosure. The CVSS score of 7.1 reflects high confidentiality impact and high availability impact, with no integrity impact. Exploitation does not require user interaction but does require local access.

A fix for this vulnerability has been implemented in the Linux kernel by adding an early return when the message length is zero in drm_log_draw_kmsg_record(). Users and administrators should apply the official Linux kernel updates that include this patch. Since no patch links are provided here, consult the official Linux kernel security advisories or distribution-specific updates for the fixed version. Patch status is not yet confirmed in this data; check vendor advisories for current remediation guidance.