CVE-2026-74635— fbdev: bitblit: bound-check glyph index in bit_cursor()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述信息的中文翻译： 在 Linux 内核中，已修复以下漏洞： fbdev: bitblit: 在 中对字形（glyph）索引进行边界检查 函数通过以下方式获取光标下的字形： 其中，当设置 时， 的值为 。屏幕缓冲区的值直接来自 ，其值可能大于当前字形的数量。 Syzkaller 通过 触发了此漏洞。调用栈显示， 中的 使用 向 写入任意 16 位值，而 中的 通过 存储该值时未检查 （字符计数）。随后， 中的 读取了该存储的值。 当字体从包含 512 个字形的字体切换为包含 256 个字形的字体时，屏
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 27
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 0998a6cb232674408a03e8561dc15aa266b2f53b< 250159ace2dc53c1bdad267aa8da51b638748700 |
affected |
db5c9a162d2f42bcc842b76b3d935dcc050a0eec< 46336f476484f36145e5117e72d7b590f47433ee |
affected | ||
c12003bf91fdff381c55ef54fef3e961a5af2545< bf750cfeacf4e47ac72dadc7f05839696efb8576 |
affected | ||
9ba1a7802ca9a2590cef95b253e6526f4364477f< 94134d70abf9273b70499d97d0adc9185ef21091 |
affected | ||
901f44227072be60812fe8083e83e1533c04eed1< c1e7351767dd30fc574395c82121e4c67b882da3 |
affected | ||
18c4ef4e765a798b47980555ed665d78b71aeadf< bc9db0d879c655d5dfd8add32fd60f13e65d132c |
affected | ||
18c4ef4e765a798b47980555ed665d78b71aeadf< 9ea879862e66e354e616028c31b39aa3eb6d35d8 |
affected | ||
18c4ef4e765a798b47980555ed665d78b71aeadf< e033cbf3975a8465f879ebd5989dc35b04423a4d |
affected | ||
| … +19 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74635
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
fbdev: bitblit: bound-check glyph index in bit_cursor()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
fbdev: bitblit: bound-check glyph index in bit_cursor()
bit_cursor() fetches the glyph under the cursor with
c = scr_readw(vc_pos);
src = vc_font.data + ((c & charmask) * w * height);
where charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer
value comes directly from scr_readw() and may be larger than the current
font's glyph count.
Syzkaller triggers this via vcs_write(). The Call Trace shows
vcs_write() in vc_screen.c writing an arbitrary 16-bit value with
writev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via
vcs_scr_writew() without checking charcount. The stored value is later
read in bit_cursor() in bitblit.c.
When the font is changed from a font with 512 glyphs to a font with
256 glyphs, the screen buffer can retain characters with the high
bit set from the previous mode, which could also produce the same
out-of-bounds access.
BUG: KASAN: global-out-of-bounds in soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70
Read of size 16 at addr ffff800086c57970
Call Trace:
soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70
bit_cursor+0xa90/0x1108 drivers/video/fbdev/core/bitblit.c:365
fbcon_cursor+0x344/0x498 drivers/video/fbdev/core/fbcon.c:1427
hide_cursor+0xdc/0x2d0 drivers/tty/vt/vt.c:883
update_region+0x100/0x18c drivers/tty/vt/vt.c:669
vcs_write+0x8ec/0xaf0 drivers/tty/vt/vc_screen.c:685
bit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph
index to vc_font.charcount. Apply the same clamp in bit_cursor() after
extracting the attribute and masking, before indexing fontdata.
The fix completes the bounds checking started in commit 18c4ef4e765a
("fbdev: bitblit: bound-check glyph index in bit_putcs*"), which missed
the cursor path.
This change should be safe because the clamp reuses the existing
contract from fbcon: charcount is maintained under console_lock in
con_font_set() and fbcon_font_set(), and hi_font_mask is cleared when
switching from 512 to 256 glyphs. When stale screen data with high bits
remains after a font switch, or when vcs_write() stores an arbitrary
value, clamping the index to 0 prevents the out-of-bounds read without
changing cursor semantics — the same fallback bit_putcs uses.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-74635
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74635
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-74635 (8)
Same Patch Batch · Linux · 2026-08-22 · 150 CVEs total
| CVE-2026-74705 | 10.0 CRITICAL | udp: fix potential use-after-free in tunnel segmentation |
| CVE-2026-74612 | 10.0 CRITICAL | veth: fix skb length accounting after XDP frag adjustment |
| CVE-2026-74587 | 9.8 CRITICAL | sctp: fix use-after-free of cached ASCONF chunk |
| CVE-2026-74591 | 9.8 CRITICAL | mm/filemap: __filemap_add_folio() restore index before retrying |
| CVE-2026-74688 | 9.8 CRITICAL | sctp: clear control chunk transport if it is being removed |
| CVE-2026-74597 | 9.8 CRITICAL | ip6_tunnel: clear skb2->cb[] in ip6ip6_err() |
| CVE-2026-74617 | 9.8 CRITICAL | dibs: initialise dibs->lock in dibs_dev_alloc() |
| CVE-2026-74616 | 9.8 CRITICAL | xdp: reject clones that overrun skb_shared_info tailroom |
| CVE-2026-74628 | 9.8 CRITICAL | net/x25: fix use-after-free of the socket by its timers |
| CVE-2026-74608 | 9.8 CRITICAL | smb: client: Fix use-after-free in cifs_try_adding_channels() |
| CVE-2026-74669 | 9.8 CRITICAL | ipvs: clear IPv4 options after rebasing tunnel ICMP errors |
| CVE-2026-74662 | 9.8 CRITICAL | inet: frags: publish queues before arming timer |
| CVE-2026-74730 | 9.8 CRITICAL | NFS: Pin the 'struct nfs_server' during a FREE_STATEID call |
| CVE-2026-74727 | 9.8 CRITICAL | ovpn: skip rehash for peers already removed from by_id |
| CVE-2026-74586 | 9.8 CRITICAL | sctp: clear new_transport when removing a peer |
| CVE-2026-74723 | 9.8 CRITICAL | btrfs: lzo: reject inline extents without valid headers |
| CVE-2026-74588 | 9.8 CRITICAL | sctp: keep chunk->transport in step with the list it is queued on |
| CVE-2026-74611 | 9.8 CRITICAL | tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| CVE-2026-74712 | 9.3 CRITICAL | vdpa/mlx5: Fix buffer length in create_direct_keys() |
| CVE-2026-74665 | 9.1 CRITICAL | net: fix skb length accounting after generic XDP frag adjustment |
Showing top 20 of 150 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-74733
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock -
CVE-2026-74732
drm/amd/display: Check for tg ops in dce110_set_avmute -
CVE-2026-74731
sched_ext: Skip sub-disable teardown for never-linked sub-sc -
CVE-2026-74730
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call -
CVE-2026-74729
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_
Same vendor: Linux
-
CVE-2026-74733
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock -
CVE-2026-74732
drm/amd/display: Check for tg ops in dce110_set_avmute -
CVE-2026-74731
sched_ext: Skip sub-disable teardown for never-linked sub-sc -
CVE-2026-74730
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call -
CVE-2026-74729
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_
V. Comments for CVE-2026-74635
No comments yet