Out-of-bounds read in Linux kernel - CVE-2026-74635

Vulnerability details

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the bit_cursor() function in drivers/video/fbdev/core/bitblit.c when processing screen buffer values as glyph indexes. A local user can write an arbitrary 16-bit value to /dev/vcsa to disclose sensitive information.

The issue can also be triggered when stale screen buffer data retains high-bit characters after switching from a 512-glyph font to a 256-glyph font.

Affected software

How to mitigate CVE-2026-74635

External References

• https://git.kernel.org/stable/c/250159ace2dc53c1bdad267aa8da51b638748700
• https://git.kernel.org/stable/c/46336f476484f36145e5117e72d7b590f47433ee
• https://git.kernel.org/stable/c/94134d70abf9273b70499d97d0adc9185ef21091
• https://git.kernel.org/stable/c/9ea879862e66e354e616028c31b39aa3eb6d35d8
• https://git.kernel.org/stable/c/bc9db0d879c655d5dfd8add32fd60f13e65d132c
• https://git.kernel.org/stable/c/bf750cfeacf4e47ac72dadc7f05839696efb8576
• https://git.kernel.org/stable/c/c1e7351767dd30fc574395c82121e4c67b882da3
• https://git.kernel.org/stable/c/e033cbf3975a8465f879ebd5989dc35b04423a4d

Related Security Bulletins

• Out-of-bounds read in Linux kernel fbdev core driver
• Debian update for linux