In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 28 byte allocation. Fix that by using the source size instead, together with a build bug on the source size actually being smaller than the destination. I hit this running KUnit tests under KASAN (while debugging something else entirely). In the real world, it seems unlikely to cause an actual problem. It is a read not a write so it can't corrupt any memory. However, it could potentially fall off the end of a page and cause an accvio bug.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80749 is a buffer over-read vulnerability in the Linux kernel's DRM (Direct Rendering Manager) subsystem, specifically in HDMI connector audio infoframe handling. A helper function incorrectly uses the destination buffer size (60 bytes) instead of the source buffer size (28 bytes) when copying audio infoframe data, resulting in an out-of-bounds memory read that can access 32 bytes beyond the allocated source. This vulnerability affects Linux systems with HDMI display connectors and could be exploited to leak sensitive kernel memory or cause system instability. The issue is particularly concerning for systems using HDMI audio capabilities, including desktops, laptops, and embedded devices running vulnerable kernel versions.
While CVE-2026-80749 does not currently map to specific MITRE ATT&CK techniques or Casky security skills, practitioners using Casky.ai would identify similar vulnerabilities through Claude AI's extended reasoning capabilities by analyzing memory safety patterns and boundary condition handling in kernel code. Security teams would detect related attack patterns through skills mapped to T1185 (Man in the Browser), T1040 (Network Sniffing), and memory corruption techniques by examining kernel memory access logs, system crashes in DRM subsystems, and unusual memory disclosure events. Organizations should patch affected Linux kernels immediately and monitor systems for suspicious HDMI-related driver behavior or kernel memory leaks that could indicate exploitation attempts.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80749. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation