CVE-2026-63949: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63949 Overview

CVE-2026-63949 is an out-of-bounds read vulnerability in the Linux kernel's auxdisplay line-display driver. The flaw resides in linedisp_display(), which unconditionally reads msg[count - 1] before checking whether count is zero. A zero-byte write to the message sysfs attribute causes the driver to access msg[-1], reading one byte before the slab allocation.

Critical Impact
A local user with write access to the auxdisplay message sysfs attribute can trigger an out-of-bounds slab read. On KASAN-enabled kernels this triggers a panic. On stock kernels it silently reads adjacent memory and, when that byte equals '\n', wraps ssize_t to -1 and passes it to kmemdup_nul().

Affected Products

Linux kernel auxdisplay line-display subsystem (drivers/auxdisplay/line-display.c)
Drivers registering via linedisp_register() / linedisp_attach(): ht16k33, max6959, img-ascii-lcd, seg-led-gpio
All Linux kernel versions containing the vulnerable linedisp_display() implementation prior to the fix commits

Discovery Timeline

2026-07-19 - CVE-2026-63949 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63949

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Linux kernel auxdisplay line-display driver. The linedisp_display() function trims a trailing newline from a user-supplied buffer before validating the buffer length. When userspace issues write(fd, "", 0) against the message sysfs attribute, the driver dereferences msg[count - 1] where count is zero, producing an access to msg[-1].

The kernfs write buffer for this store is a 1-byte allocation. kernfs_fop_write_iter() calls kmalloc(len + 1) with len == 0, so msg[-1] reads one byte immediately before the slab object. Neither vfs_write() nor kernfs_fop_write_iter() short-circuits on count == 0, so the store callback is dispatched regardless.

Root Cause

The root cause is an ordering error between input validation and buffer access. linedisp_display() performs the newline-trim check msg[count - 1] == '\n' before the existing if (!count) guard runs. The fix wraps the trailing-newline trim inside a count check, ensuring the clear-display path handles zero-length writes without dereferencing the buffer.

Attack Vector

The vulnerable code path is reachable only from userspace via the message sysfs attribute, which is registered with mode 0644. A local user with write permission to that attribute triggers the flaw by issuing a zero-byte write() syscall. On KASAN-enabled kernels the resulting slab-out-of-bounds report panics the system, producing a denial of service. On stock kernels the out-of-bounds byte is read silently. If the adjacent byte happens to equal '\n', the subsequent count-- operation underflows ssize_t from 0 to -1, which is then passed to kmemdup_nul(), corrupting downstream length handling.

The in-tree initial-message setup path calls linedisp_display() with count == -1 and is unaffected. The vulnerability is exclusively userspace-triggerable through the sysfs write path. See the kernel commit fix for the corrected implementation.

Detection Methods for CVE-2026-63949

Indicators of Compromise

KASAN slab-out-of-bounds reports in dmesg referencing linedisp_display or message_store from drivers/auxdisplay/line-display.c
Unexpected kernel panics on systems with ht16k33, max6959, img-ascii-lcd, or seg-led-gpio drivers loaded
Zero-byte write() syscalls targeting sysfs paths ending in /message under /sys/class/auxdisplay/

Detection Strategies

Audit auditd or eBPF telemetry for write syscalls with count == 0 targeting auxdisplay sysfs attributes
Monitor kernel logs for KASAN reports naming linedisp_display, message_store, or kmemdup_nul in the call stack
Inventory running kernels against the fix commits listed in the vendor advisory to identify unpatched hosts

Monitoring Recommendations

Enable KASAN on test and staging kernels to surface the out-of-bounds read deterministically before production deployment
Alert on repeated kernel panics or oops events referencing the auxdisplay subsystem across managed Linux fleets
Correlate local-user activity with sysfs writes to embedded-display attributes on IoT and industrial devices where these drivers are commonly loaded

How to Mitigate CVE-2026-63949

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits that guard the trailing-newline trim with a count check
Restrict write access to /sys/class/auxdisplay/*/message to trusted administrative accounts only
Unload the affected drivers (ht16k33, max6959, img-ascii-lcd, seg-led-gpio) on systems that do not require auxiliary display functionality

Patch Information

The fix is committed to the Linux stable tree across multiple branches. Relevant commits include 197476b1, 3859960d, 6ad4f75e, 8776032f, a7511dcd, and ca5b0781. Each backport adds a count check around the trailing-newline trim in linedisp_display() so that zero-length writes take the existing clear-display path without dereferencing msg[-1]. Distribution kernels should pick up the fix from their respective stable-tree updates.

Workarounds

Change permissions on the message sysfs attribute to remove write access for non-root users where the driver cannot be unloaded
Blacklist the auxdisplay line-display client drivers via /etc/modprobe.d/ on systems without physical auxiliary displays
Disable KASAN in production only after patching, since KASAN converts the silent OOB read into a panic that aids identification during testing

bash

# Configuration example
# Remove world/group write access to auxdisplay message attributes
chmod 600 /sys/class/auxdisplay/*/message

# Blacklist affected drivers on hosts without auxiliary displays
cat <<EOF > /etc/modprobe.d/blacklist-auxdisplay.conf
blacklist ht16k33
blacklist max6959
blacklist img-ascii-lcd
blacklist seg-led-gpio
EOF