CVE-2026-74635

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: bitblit: bound-check glyph index in bit_cursor()

bit_cursor() fetches the glyph under the cursor with

c = scr_readw(vc_pos);

src = vc_font.data + ((c & charmask) * w * height);

where charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer

value comes directly from scr_readw() and may be larger than the current

font's glyph count.

Syzkaller triggers this via vcs_write(). The Call Trace shows

vcs_write() in vc_screen.c writing an arbitrary 16-bit value with

writev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via

vcs_scr_writew() without checking charcount. The stored value is later

read in bit_cursor() in bitblit.c.

When the font is changed from a font with 512 glyphs to a font with

256 glyphs, the screen buffer can retain characters with the high

bit set from the previous mode, which could also produce the same

out-of-bounds access.

BUG: KASAN: global-out-of-bounds in soft_curso

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References