{"id":"CVE-2026-74635","state":"PUBLISHED","title":"fbdev: bitblit: bound-check glyph index in bit_cursor()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: bitblit: bound-check glyph index in bit_cursor()\n\nbit_cursor() fetches the glyph under the cursor with\n\n\tc = scr_readw(vc_pos);\n\tsrc = vc_font.data + ((c & charmask) * w * height);\n\nwhere charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer\nvalue comes directly from scr_readw() and may be larger than the current\nfont's glyph count.\n\nSyzkaller triggers this via vcs_write(). The Call Trace shows\nvcs_write() in vc_screen.c writing an arbitrary 16-bit value with\nwritev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via\nvcs_scr_writew() without checking charcount. The stored value is later\nread in bit_cursor() in bitblit.c.\n\nWhen the font is changed from a font with 512 glyphs to a font with\n256 glyphs, the screen buffer can retain characters with the high\nbit set from the previous mode, which could also produce the same\nout-of-bounds access.\n\n  BUG: KASAN: global-out-of-bounds in soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70\n  Read of size 16 at addr ffff800086c57970\n\n  Call Trace:\n   soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70\n   bit_cursor+0xa90/0x1108 drivers/video/fbdev/core/bitblit.c:365\n   fbcon_cursor+0x344/0x498 drivers/video/fbdev/core/fbcon.c:1427\n   hide_cursor+0xdc/0x2d0 drivers/tty/vt/vt.c:883\n   update_region+0x100/0x18c drivers/tty/vt/vt.c:669\n   vcs_write+0x8ec/0xaf0 drivers/tty/vt/vc_screen.c:685\n\nbit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph\nindex to vc_font.charcount. Apply the same clamp in bit_cursor() after\nextracting the attribute and masking, before indexing fontdata.\n\nThe fix completes the bounds checking started in commit 18c4ef4e765a\n(\"fbdev: bitblit: bound-check glyph index in bit_putcs*\"), which missed\nthe cursor path.\n\nThis change should be safe because the clamp reuses the existing\ncontract from fbcon: charcount is maintained under console_lock in\ncon_font_set() and fbcon_font_set(), and hi_font_mask is cleared when\nswitching from 512 to 256 glyphs. When stale screen data with high bits\nremains after a font switch, or when vcs_write() stores an arbitrary\nvalue, clamping the index to 0 prevents the out-of-bounds read without\nchanging cursor semantics — the same fallback bit_putcs uses.","publishedAt":"2026-08-22T15:32:15.280Z","updatedAt":"2026-10-16T19:06:04.057Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0998a6cb232674408a03e8561dc15aa266b2f53b","status":"affected","lessThan":"250159ace2dc53c1bdad267aa8da51b638748700","versionType":"git"},{"version":"db5c9a162d2f42bcc842b76b3d935dcc050a0eec","status":"affected","lessThan":"46336f476484f36145e5117e72d7b590f47433ee","versionType":"git"},{"version":"c12003bf91fdff381c55ef54fef3e961a5af2545","status":"affected","lessThan":"bf750cfeacf4e47ac72dadc7f05839696efb8576","versionType":"git"},{"version":"9ba1a7802ca9a2590cef95b253e6526f4364477f","status":"affected","lessThan":"94134d70abf9273b70499d97d0adc9185ef21091","versionType":"git"},{"version":"901f44227072be60812fe8083e83e1533c04eed1","status":"affected","lessThan":"c1e7351767dd30fc574395c82121e4c67b882da3","versionType":"git"},{"version":"18c4ef4e765a798b47980555ed665d78b71aeadf","status":"affected","lessThan":"bc9db0d879c655d5dfd8add32fd60f13e65d132c","versionType":"git"},{"version":"18c4ef4e765a798b47980555ed665d78b71aeadf","status":"affected","lessThan":"9ea879862e66e354e616028c31b39aa3eb6d35d8","versionType":"git"},{"version":"18c4ef4e765a798b47980555ed665d78b71aeadf","status":"affected","lessThan":"e033cbf3975a8465f879ebd5989dc35b04423a4d","versionType":"git"},{"version":"a10cede006f9614b465cf25609a8753efbfd45cc","status":"affected","versionType":"git"},{"version":"efaf89a75a29b2d179bf4fe63ca62852e93ad620","status":"affected","versionType":"git"},{"version":"5.10.247","status":"affected","lessThan":"5.10.265","versionType":"semver"},{"version":"5.15.197","status":"affected","lessThan":"5.15.216","versionType":"semver"},{"version":"6.1.159","status":"affected","lessThan":"6.1.183","versionType":"semver"},{"version":"6.6.117","status":"affected","lessThan":"6.6.152","versionType":"semver"},{"version":"6.12.58","status":"affected","lessThan":"6.12.104","versionType":"semver"},{"version":"5.4.302","status":"affected","lessThan":"5.5","versionType":"semver"},{"version":"6.17.8","status":"affected","lessThan":"6.18","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/core/bitblit.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.18","versionType":"semver"},{"version":"5.10.265","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.152","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.104","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.45","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.9","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/core/bitblit.c"]}],"references":["https://git.kernel.org/stable/c/250159ace2dc53c1bdad267aa8da51b638748700","https://git.kernel.org/stable/c/46336f476484f36145e5117e72d7b590f47433ee","https://git.kernel.org/stable/c/bf750cfeacf4e47ac72dadc7f05839696efb8576","https://git.kernel.org/stable/c/94134d70abf9273b70499d97d0adc9185ef21091","https://git.kernel.org/stable/c/c1e7351767dd30fc574395c82121e4c67b882da3","https://git.kernel.org/stable/c/bc9db0d879c655d5dfd8add32fd60f13e65d132c","https://git.kernel.org/stable/c/9ea879862e66e354e616028c31b39aa3eb6d35d8","https://git.kernel.org/stable/c/e033cbf3975a8465f879ebd5989dc35b04423a4d"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74635.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74635","state":"PUBLISHED","datePublished":"2026-08-22T15:32:15.280Z","dateUpdated":"2026-10-16T19:06:04.057Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.922Z"},"containers":{"cna":{"title":"fbdev: bitblit: bound-check glyph index in bit_cursor()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: bitblit: bound-check glyph index in bit_cursor()\n\nbit_cursor() fetches the glyph under the cursor with\n\n\tc = scr_readw(vc_pos);\n\tsrc = vc_font.data + ((c & charmask) * w * height);\n\nwhere charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer\nvalue comes directly from scr_readw() and may be larger than the current\nfont's glyph count.\n\nSyzkaller triggers this via vcs_write(). The Call Trace shows\nvcs_write() in vc_screen.c writing an arbitrary 16-bit value with\nwritev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via\nvcs_scr_writew() without checking charcount. The stored value is later\nread in bit_cursor() in bitblit.c.\n\nWhen the font is changed from a font with 512 glyphs to a font with\n256 glyphs, the screen buffer can retain characters with the high\nbit set from the previous mode, which could also produce the same\nout-of-bounds access.\n\n  BUG: KASAN: global-out-of-bounds in soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70\n  Read of size 16 at addr ffff800086c57970\n\n  Call Trace:\n   soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70\n   bit_cursor+0xa90/0x1108 drivers/video/fbdev/core/bitblit.c:365\n   fbcon_cursor+0x344/0x498 drivers/video/fbdev/core/fbcon.c:1427\n   hide_cursor+0xdc/0x2d0 drivers/tty/vt/vt.c:883\n   update_region+0x100/0x18c drivers/tty/vt/vt.c:669\n   vcs_write+0x8ec/0xaf0 drivers/tty/vt/vc_screen.c:685\n\nbit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph\nindex to vc_font.charcount. Apply the same clamp in bit_cursor() after\nextracting the attribute and masking, before indexing fontdata.\n\nThe fix completes the bounds checking started in commit 18c4ef4e765a\n(\"fbdev: bitblit: bound-check glyph index in bit_putcs*\"), which missed\nthe cursor path.\n\nThis change should be safe because the clamp reuses the existing\ncontract from fbcon: charcount is maintained under console_lock in\ncon_font_set() and fbcon_font_set(), and hi_font_mask is cleared when\nswitching from 512 to 256 glyphs. When stale screen data with high bits\nremains after a font switch, or when vcs_write() stores an arbitrary\nvalue, clamping the index to 0 prevents the out-of-bounds read without\nchanging cursor semantics — the same fallback bit_putcs uses."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0998a6cb232674408a03e8561dc15aa266b2f53b","status":"affected","lessThan":"250159ace2dc53c1bdad267aa8da51b638748700","versionType":"git"},{"version":"db5c9a162d2f42bcc842b76b3d935dcc050a0eec","status":"affected","lessThan":"46336f476484f36145e5117e72d7b590f47433ee","versionType":"git"},{"version":"c12003bf91fdff381c55ef54fef3e961a5af2545","status":"affected","lessThan":"bf750cfeacf4e47ac72dadc7f05839696efb8576","versionType":"git"},{"version":"9ba1a7802ca9a2590cef95b253e6526f4364477f","status":"affected","lessThan":"94134d70abf9273b70499d97d0adc9185ef21091","versionType":"git"},{"version":"901f44227072be60812fe8083e83e1533c04eed1","status":"affected","lessThan":"c1e7351767dd30fc574395c82121e4c67b882da3","versionType":"git"},{"version":"18c4ef4e765a798b47980555ed665d78b71aeadf","status":"affected","lessThan":"bc9db0d879c655d5dfd8add32fd60f13e65d132c","versionType":"git"},{"version":"18c4ef4e765a798b47980555ed665d78b71aeadf","status":"affected","lessThan":"9ea879862e66e354e616028c31b39aa3eb6d35d8","versionType":"git"},{"version":"18c4ef4e765a798b47980555ed665d78b71aeadf","status":"affected","lessThan":"e033cbf3975a8465f879ebd5989dc35b04423a4d","versionType":"git"},{"version":"a10cede006f9614b465cf25609a8753efbfd45cc","status":"affected","versionType":"git"},{"version":"efaf89a75a29b2d179bf4fe63ca62852e93ad620","status":"affected","versionType":"git"},{"version":"5.10.247","status":"affected","lessThan":"5.10.265","versionType":"semver"},{"version":"5.15.197","status":"affected","lessThan":"5.15.216","versionType":"semver"},{"version":"6.1.159","status":"affected","lessThan":"6.1.183","versionType":"semver"},{"version":"6.6.117","status":"affected","lessThan":"6.6.152","versionType":"semver"},{"version":"6.12.58","status":"affected","lessThan":"6.12.104","versionType":"semver"},{"version":"5.4.302","status":"affected","lessThan":"5.5","versionType":"semver"},{"version":"6.17.8","status":"affected","lessThan":"6.18","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/core/bitblit.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.18","versionType":"semver"},{"version":"5.10.265","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.152","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.104","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.45","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.9","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/core/bitblit.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/250159ace2dc53c1bdad267aa8da51b638748700"},{"url":"https://git.kernel.org/stable/c/46336f476484f36145e5117e72d7b590f47433ee"},{"url":"https://git.kernel.org/stable/c/bf750cfeacf4e47ac72dadc7f05839696efb8576"},{"url":"https://git.kernel.org/stable/c/94134d70abf9273b70499d97d0adc9185ef21091"},{"url":"https://git.kernel.org/stable/c/c1e7351767dd30fc574395c82121e4c67b882da3"},{"url":"https://git.kernel.org/stable/c/bc9db0d879c655d5dfd8add32fd60f13e65d132c"},{"url":"https://git.kernel.org/stable/c/9ea879862e66e354e616028c31b39aa3eb6d35d8"},{"url":"https://git.kernel.org/stable/c/e033cbf3975a8465f879ebd5989dc35b04423a4d"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local write() to /dev/vcsa (or ioctl on an owned virtual console) to poison the VT screen buffer; the bug is in fbcon cursor rendering, not in any network-facing protocol handler.\nAC:L - Syzkaller reproduces the fault reliably by writing arbitrary screen-buffer values to /dev/vcsa; the attacker fully controls the glyph index and can repeat the trigger on every console refresh without races or victim-specific timing.\nPR:L - Triggering needs only a local account with write access to /dev/vcsa* (typically membership in the tty group) or a session owning the target console for KDFONTOP/font-switch paths; no CAP_SYS_ADMIN or init-namespace root is required.\nUI:N - Once the attacker has the needed local device access, exploitation is fully self-contained and does not require any additional action from another user or administrator.\nS:U - Impact is confined to kernel framebuffer-console memory within the same kernel security domain; it does not cross VM, container, or IOMMU boundaries to affect a separate authority.\nC:H - An out-of-bounds read past the font glyph table copies adjacent kernel memory (global or heap font data) into cursor buffers and framebuffer blit paths, disclosing more than a few bytes per trigger.\nI:H - The out-of-bounds glyph pointer feeds update_attr() and soft_cursor() memcpy paths that copy attacker-influenced kernel memory into kmalloc cursor buffers and framebuffer state, constituting kernel memory corruption with integrity impact.\nA:H - KASAN reports a kernel BUG on the out-of-bounds read in soft_cursor(), and repeated malicious /dev/vcsa writes force console refresh through hide_cursor(), enabling kernel oops/panic and console denial of service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-25T05:40:59.420Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.247","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.197","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.159","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.117","versionEndExcluding":"6.6.152"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.58","versionEndExcluding":"6.12.104"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"6.18.45"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.1.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.302"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17.8"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-74635","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T19:03:10.782063Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:06:04.057Z"}}]}}}