UBUNTU-CVE-2026-89806: Integer Overflow
In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: ofdrm: Fix integer overflow in fbsize calculation The framebuffer size calculation fbsize = linebytes height can overflow when both values are large (e.g., 46341 46341 > INTMAX). Since linebytes and height are both int types, the multiplication is performed as int int, which results in undefined behavior on overflow. Use checkmuloverflow() to detect and prevent this overflow, consistent with the approach used in simpledrm.c and corebootdrm.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In drm/sysfb/ofdrm, use check_mul_overflow() when calculating fb_size from linebytes * height to detect and prevent integer overflow.
Event History
Frequently Asked Questions
Which systems are within the listed scope?
The listed affected Ubuntu kernel packages are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.
What condition triggers the vulnerable calculation?
The issue occurs when the OF DRM framebuffer size is calculated from linebytes multiplied by height and both values are sufficiently large to overflow an int. An example given is 46341 multiplied by 46341, which exceeds INT_MAX.
What is the impact of the overflow?
Because both operands are int types, the multiplication can cause undefined behavior on overflow. The vulnerability is rated high with confidentiality, integrity, and availability impacts all marked high.
What does the fix do?
The resolution replaces the unchecked framebuffer-size multiplication with check_mul_overflow(), so oversized linebytes and height values are detected rather than allowed to overflow.