Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-90245— fbdev: kyro: Validate overlay viewport coordinates

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到解决： fbdev: kyro：校验叠加层视口坐标 叠加层视口的结束坐标是基于视口原点（origin）和尺寸，使用 32 位无符号算术进行计算的。较大的输入值可能导致这些计算发生回绕（wrap around），在将结果坐标传递给 之前就已经发生了溢出。 将视口坐标打包进 16 位的寄存器字段。此外，X 坐标在写入前还会分别加 2 和 1 进行调整。因此，需要校验坐标计算是否发生 32 位回绕，并确保调整后的坐标能够适配其对应的 16 位寄存器字段，然后再调用 。 该漏洞由 Li

AI Predicted 5.5 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< d8c1a9579cbd8f4ac5cbd5a10f1afb5ee64adf30 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 2ac6e30a552e6f9932c21c865a5c69f40c8aef64 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 413d763439ba68e5d547538e6b6c7de97d5818a5 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< e8d4e4cf388daeb49704f3de10b203034f28eb90 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< a6decd4e72fc5846d3b268bd085a2089213fd5ee affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 33e54e3e0b2ca959304e62c3d84f0ad49bbe1afe affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 7bf36dc23bcf3496dec274a46ae0aaff4961ea03 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 7b5c7bc55e13e7f5ac7b1eaf5c6d690389ea5ee3 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90245

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fbdev: kyro: Validate overlay viewport coordinates
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: kyro: Validate overlay viewport coordinates The overlay viewport end coordinates are computed from the viewport origin and dimensions using 32-bit unsigned arithmetic. Large input values can cause these calculations to wrap around before the resulting coordinates are passed to SetOverlayViewPort(). SetOverlayViewPort() packs the viewport coordinates into 16-bit register fields. The X coordinates are additionally adjusted by +2 and +1 before being written. Validate the coordinate calculations for 32-bit wraparound and ensure that the adjusted coordinates fit within their 16-bit register fields before calling SetOverlayViewPort(). Found by Linux Verification Center (linuxtesting.org) with SVACE.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ d8c1a9579cbd8f4ac5cbd5a10f1afb5ee64adf30 -
Linux Linux 2.6.12 -

II. Public POCs for CVE-2026-90245

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90245

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90245 (5)

Other References for CVE-2026-90245 (3)

Same Patch Batch · Linux · 2026-09-17 · 602 CVEs total

CVE-2026-90257 Bluetooth: virtio_bt: avoid OOB read of build info string
CVE-2026-90238 media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path
CVE-2026-90240 iommu/vt-d: Flush context cache with correct SID when tearing down aliases
CVE-2026-90239 media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem()
CVE-2026-90241 iommu/vt-d: Tear down scalable-mode context on probe failure
CVE-2026-90243 iommu/vt-d: Clear Present bit before tearing down copied context entry
CVE-2026-90242 iommu/vt-d: Fix iopf_refcount leak on RID domain replacement
CVE-2026-90244 iommu/dma: Restore locking around msi_page_list
CVE-2026-90246 apparmor: fix integer overflow in verify_tags() bounds check
CVE-2026-90247 bpf: Fix mmap_lock leak in irq_work path
CVE-2026-90248 net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
CVE-2026-90249 iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
CVE-2026-90250 bpf, cgroup: Fix storage null-ptr-deref after replacing prog
CVE-2026-90251 Bluetooth: MSFT: validate evt_prefix_len against the response length
CVE-2026-90253 Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
CVE-2026-90252 Bluetooth: MGMT: free the HCI command when it is cancelled
CVE-2026-90254 Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
CVE-2026-90256 Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
CVE-2026-90255 Bluetooth: hci_conn: fix the SCO setup context lifetime
CVE-2026-90267 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails

Showing top 20 of 602 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90245

No comments yet

Leave a comment