fbdev: bitblit: bound-check glyph index in bit_cursor()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74635
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-22 16:16:36 UTC
Updated2026-08-25 06:18:42 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_cursor() bit_cursor() fetches the glyph under the cursor with c = scr_readw(vc_pos); src = vc_font.data + ((c & charmask) * w * height); where charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer value comes directly from scr_readw() and may be larger than the current font's glyph count. Syzkaller triggers this via vcs_write(). The Call Trace shows vcs_write() in vc_screen.c writing an arbitrary 16-bit value with writev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via vcs_scr_writew() without checking charcount. The stored value is later read in bit_cursor() in bitblit.c. When the font is changed from a font with 512 glyphs to a font with 256 glyphs, the screen buffer can retain characters with the high bit set from the previous mode, which could also produce the same out-of-bounds access. BUG: KASAN: global-out-of-bounds in soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70 Read of size 16 at addr ffff800086c57970 Call Trace: soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70 bit_cursor+0xa90/0x1108 drivers/video/fbdev/core/bitblit.c:365 fbcon_cursor+0x344/0x498 drivers/video/fbdev/core/fbcon.c:1427 hide_cursor+0xdc/0x2d0 drivers/tty/vt/vt.c:883 update_region+0x100/0x18c drivers/tty/vt/vt.c:669 vcs_write+0x8ec/0xaf0 drivers/tty/vt/vc_screen.c:685 bit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph index to vc_font.charcount. Apply the same clamp in bit_cursor() after extracting the attribute and masking, before indexing fontdata. The fix completes the bounds checking started in commit 18c4ef4e765a ("fbdev: bitblit: bound-check glyph index in bit_putcs*"), which missed the cursor path. This change should be safe because the clamp reuses the existing contract from fbcon: charcount is maintained under console_lock in con_font_set() and fbcon_font_set(), and hi_font_mask is cleared when switching from 512 to 256 glyphs. When stale screen data with high bits remains after a font switch, or when vcs_write() stores an arbitrary value, clamping the index to 0 prevents the out-of-bounds read without changing cursor semantics — the same fallback bit_putcs uses.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001290000 probability, percentile 0.028160000 (date 2026-08-25)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 0998a6cb232674408a03e8561dc15aa266b2f53b 250159ace2dc53c1bdad267aa8da51b638748700 git Not specified
CNA Linux Linux affected db5c9a162d2f42bcc842b76b3d935dcc050a0eec 46336f476484f36145e5117e72d7b590f47433ee git Not specified
CNA Linux Linux affected c12003bf91fdff381c55ef54fef3e961a5af2545 bf750cfeacf4e47ac72dadc7f05839696efb8576 git Not specified
CNA Linux Linux affected 9ba1a7802ca9a2590cef95b253e6526f4364477f 94134d70abf9273b70499d97d0adc9185ef21091 git Not specified
CNA Linux Linux affected 901f44227072be60812fe8083e83e1533c04eed1 c1e7351767dd30fc574395c82121e4c67b882da3 git Not specified
CNA Linux Linux affected 18c4ef4e765a798b47980555ed665d78b71aeadf bc9db0d879c655d5dfd8add32fd60f13e65d132c git Not specified
CNA Linux Linux affected 18c4ef4e765a798b47980555ed665d78b71aeadf 9ea879862e66e354e616028c31b39aa3eb6d35d8 git Not specified
CNA Linux Linux affected 18c4ef4e765a798b47980555ed665d78b71aeadf e033cbf3975a8465f879ebd5989dc35b04423a4d git Not specified
CNA Linux Linux affected a10cede006f9614b465cf25609a8753efbfd45cc git Not specified
CNA Linux Linux affected efaf89a75a29b2d179bf4fe63ca62852e93ad620 git Not specified
CNA Linux Linux affected 5.10.247 5.10.265 semver Not specified
CNA Linux Linux affected 5.15.197 5.15.216 semver Not specified
CNA Linux Linux affected 6.1.159 6.1.183 semver Not specified
CNA Linux Linux affected 6.6.117 6.6.152 semver Not specified
CNA Linux Linux affected 6.12.58 6.12.104 semver Not specified
CNA Linux Linux affected 5.4.302 5.5 semver Not specified
CNA Linux Linux affected 6.17.8 6.18 semver Not specified
CNA Linux Linux affected 6.18 Not specified
CNA Linux Linux unaffected 6.18 semver Not specified
CNA Linux Linux unaffected 5.10.265 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.216 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.183 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.152 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.104 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.45 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.9 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/46336f476484f36145e5117e72d7b590f47433ee 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9ea879862e66e354e616028c31b39aa3eb6d35d8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c1e7351767dd30fc574395c82121e4c67b882da3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e033cbf3975a8465f879ebd5989dc35b04423a4d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/bf750cfeacf4e47ac72dadc7f05839696efb8576 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/94134d70abf9273b70499d97d0adc9185ef21091 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/250159ace2dc53c1bdad267aa8da51b638748700 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/bc9db0d879c655d5dfd8add32fd60f13e65d132c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report