CVE-2026-89806: drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
In the Linux kernel, the following vulnerability has been resolved:
drm/sysfb: ofdrm: Fix integer overflow in fbsize calculation
The framebuffer size calculation fbsize = linebytes height can overflow when both values are large (e.g., 46341 46341 > INTMAX). Since linebytes and height are both int types, the multiplication is performed as int int, which results in undefined behavior on overflow.
Use checkmuloverflow() to detect and prevent this overflow, consistent with the approach used in simpledrm.c and corebootdrm.c.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to the overflow condition?
Linux kernel systems using the ofdrm framebuffer path are exposed when framebuffer linebytes and height are both large enough that their integer product exceeds INT_MAX; the example given is 46341 multiplied by 46341.
What does the fix change?
The fix replaces the unchecked int multiplication used for framebuffer size calculation with check_mul_overflow(), so oversized linebytes and height values are detected rather than allowed to overflow.