CVE-2026-74635: fbdev: bitblit: bound-check glyph index in bit_cursor()
fbdev: bitblit: bound-check glyph index in bitcursor()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1 - Upgrade
Upgrade
Linux kernel drivers/video/fbdev/core/softcursor.cto a version that resolves this vulnerability.Patch commit 18c4ef4e765a
Event History
Frequently Asked Questions
What access does an attacker need to trigger the out-of-bounds access?
The triggering path described requires the ability to write arbitrary 16-bit screen-buffer values through writev() to /dev/vcsa. Those values are stored without validating them against the active font's glyph count and are later used when the cursor is rendered.
What conditions can leave a system with invalid glyph values already stored in the screen buffer?
Changing from a font with 512 glyphs to one with 256 glyphs can leave previously stored characters with the high bit set in the screen buffer. When bit_cursor() later reads one of those values, it can calculate an address beyond the current font data.
What can be done while a fix cannot be deployed?
Restrict untrusted users and processes from writing to /dev/vcsa, since the reported reproducer uses that interface to place unchecked values in the screen buffer. Avoid font transitions from 512-glyph fonts to 256-glyph fonts where possible, as this can preserve invalid character indices.