CVE-2026-90245

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: kyro: Validate overlay viewport coordinates

The overlay viewport end coordinates are computed from the viewport

origin and dimensions using 32-bit unsigned arithmetic. Large input

values can cause these calculations to wrap around before the resulting

coordinates are passed to SetOverlayViewPort().

SetOverlayViewPort() packs the viewport coordinates into 16-bit

register fields. The X coordinates are additionally adjusted by +2

and +1 before being written. Validate the coordinate calculations

for 32-bit wraparound and ensure that the adjusted coordinates fit

within their 16-bit register fields before calling

SetOverlayViewPort().

Found by Linux Verification Center (linuxtesting.org) with SVACE.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References