UBUNTU-CVE-2026-74635: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor() bitcursor() fetches the glyph under the cursor with c = scrreadw(vcpos); src = vcfont.data + ((c & charmask) w height); where charmask is 0x1ff when vchifontmask is set. The screen buffer value comes directly from scrreadw() and may be larger than the current font's glyph count. Syzkaller triggers this via vcswrite(). The Call Trace shows vcswrite() in vcscreen.c writing an arbitrary 16-bit value with writev() to /dev/vcsa, which vcswritebuf() in vcscreen.c stores via vcsscrwritew() without checking charcount. The stored value is later read in bitcursor() in bitblit.c. When the font is changed from a font with 512 glyphs to a font with 256 glyphs, the screen buffer can retain characters with the high bit set from the previous mode, which could also produce the same out-of-bounds access. BUG: KASAN: global-out-of-bounds in softcursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70 Read of size 16 at addr ffff800086c57970 Call Trace: softcursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70 bitcursor+0xa90/0x1108 drivers/video/fbdev/core/bitblit.c:365 fbconcursor+0x344/0x498 drivers/video/fbdev/core/fbcon.c:1427 hidecursor+0xdc/0x2d0 drivers/tty/vt/vt.c:883 updateregion+0x100/0x18c drivers/tty/vt/vt.c:669 vcswrite+0x8ec/0xaf0 drivers/tty/vt/vcscreen.c:685 bitputcsaligned() and bitputcsunaligned() already clamp the glyph index to vcfont.charcount. Apply the same clamp in bitcursor() after extracting the attribute and masking, before indexing fontdata. The fix completes the bounds checking started in commit 18c4ef4e765a ("fbdev: bitblit: bound-check glyph index in bitputcs"), which missed the cursor path. This change should be safe because the clamp reuses the existing contract from fbcon: charcount is maintained under consolelock in confontset() and fbconfontset(), and hifontmask is cleared when switching from 512 to 256 glyphs. When stale screen data with high bits remains after a font switch, or when vcswrite() stores an arbitrary value, clamping the index to 0 prevents the out-of-bounds read without changing cursor semantics — the same fallback bitputcs uses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1117.124~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1123.132~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1122.131~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1118.128~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-198.208~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1111.115~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1112.118~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-195.205~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1114.120~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1111.115~20.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-198.208 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1117.124 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1123.132 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1122.131 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1118.128 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1113.119 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1100.108 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1111.115 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1112.118 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1109.114 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-195.205 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1112.113 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1114.120 - Upgrade
Upgrade
ubuntu/linux-xilinx-zynqmpto a version that resolves this vulnerability.Fixed in 5.15.0-1080.84 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1101.103 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1109.111 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1116.125 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1117.124+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1123.132+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-198.208+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1118.128+fips1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Compensating control
In bit_cursor(), after extracting and masking the glyph attribute and before indexing vc_font.data/fontdata, clamp the glyph index to 0 when it is outside the current font's charcount.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running one of the listed Ubuntu kernel packages are in scope. Exploitation requires local access with low privileges; the supplied severity vector rates the attack vector as local and privileges required as low.
What access does an attacker need to trigger the out-of-bounds read?
The triggering path uses writev() to write arbitrary 16-bit screen-buffer values through /dev/vcsa. Those values can later be consumed by the framebuffer console cursor code without being constrained to the active font's glyph count.
Are there configuration or state conditions that can expose the bug?
The issue can occur when screen-buffer glyph values exceed the current font's glyph count. One documented case is changing from a 512-glyph font to a 256-glyph font while high-bit character values remain in the screen buffer.
How can I assess whether a system may already be affected?
Look for KASAN reports of a global out-of-bounds read in soft_cursor or bit_cursor, particularly during framebuffer-console cursor handling. Systems where /dev/vcsa can be written with arbitrary values or where console fonts have changed between 512- and 256-glyph modes warrant review.