CVE-2026-74635 Overview
CVE-2026-74635 is an out-of-bounds read vulnerability in the Linux kernel's framebuffer console (fbdev) subsystem. The flaw resides in bit_cursor() within drivers/video/fbdev/core/bitblit.c, which fetches a glyph under the cursor without bounds-checking the glyph index against vc_font.charcount. A local attacker can trigger reads beyond the font glyph array by writing arbitrary 16-bit values to /dev/vcsa or by switching from a 512-glyph font to a 256-glyph font while stale high-bit characters remain in the screen buffer. Syzkaller reproduces the flaw through vcs_write(), producing a KASAN global-out-of-bounds report in soft_cursor().
Critical Impact
Local users with access to virtual console screen devices can trigger kernel out-of-bounds reads leading to memory disclosure, kernel instability, or potential exploitation chains against confidentiality, integrity, and availability.
Affected Products
- Linux kernel fbdev framebuffer console subsystem
- Systems using bitblit cursor rendering via bit_cursor()
- Distributions shipping unpatched stable kernel branches referenced in the upstream fix commits
Discovery Timeline
- 2026-08-22 - CVE-2026-74635 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74635
Vulnerability Analysis
The defect is an [CWE-125] out-of-bounds read in the framebuffer console cursor rendering path. bit_cursor() reads a 16-bit character value from the screen buffer using scr_readw(vc_pos), applies a charmask of 0x1ff when vc_hi_font_mask is set, and uses the result to index vc_font.data:
The function computes src = vc_font.data + ((c & charmask) * w * height) without validating that the masked index is less than vc_font.charcount. When the resident font provides fewer glyphs than the mask allows, the indexed offset points past the end of the font data buffer. soft_cursor() then reads 16 bytes from that address, tripping KASAN in drivers/video/fbdev/core/softcursor.c:70.
The sibling functions bit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph index. Commit 18c4ef4e765a introduced that clamp for the text-drawing path but did not cover the cursor path.
Root Cause
The root cause is missing input validation on attacker-controlled screen buffer values consumed by kernel rendering routines. Userspace can write arbitrary 16-bit code points to /dev/vcsa via vcs_write() in drivers/tty/vt/vc_screen.c, which stores them with vcs_scr_writew() without validating against vc_font.charcount. A stale screen buffer left over from a 512-glyph font also survives a switch to a 256-glyph font, producing the same overrun during subsequent cursor updates.
Attack Vector
Exploitation requires local access and low privileges. An attacker with write access to /dev/vcsa* or the ability to change the console font issues a writev() containing a code point whose masked value exceeds charcount - 1. The next cursor update in hide_cursor() invokes fbcon_cursor(), then bit_cursor(), and finally soft_cursor(), which dereferences the out-of-bounds glyph pointer.
The upstream fix, distributed across kernel git commits 250159a, 46336f4, 94134d7, 9ea8798, bc9db0d, bf750cf, c1e7351, and e033cbf3, adds the same clamp used by bit_putcs* to bit_cursor() after masking, falling back to glyph index 0 when the value is out of range.
Detection Methods for CVE-2026-74635
Indicators of Compromise
- KASAN reports referencing global-out-of-bounds in soft_cursor or bit_cursor in kernel logs.
- Unexpected processes issuing writev() or write() syscalls against /dev/vcsa, /dev/vcsa0, or other virtual console screen devices.
- Console font changes (KDFONTOP, PIO_FONTX) followed shortly by writes to /dev/vcsa* from non-administrative processes.
Detection Strategies
- Enable KASAN on test and pre-production kernels to surface the out-of-bounds read during fuzzing or regression runs.
- Audit kernel ring buffer output for BUG: KASAN entries with call stacks traversing fbcon_cursor and soft_cursor.
- Correlate syzkaller-style workloads and unprivileged writev() activity against virtual console devices with subsequent kernel warnings.
Monitoring Recommendations
- Monitor auditd rules covering open, write, and ioctl on /dev/vcsa* and /dev/tty* for non-root callers.
- Alert on repeated KDFONTOP ioctls that switch between 512-glyph and 256-glyph fonts on production systems.
- Track kernel oops and panic counters exposed through /proc/sys/kernel/tainted and centralized log pipelines.
How to Mitigate CVE-2026-74635
Immediate Actions Required
- Apply the upstream Linux stable kernel patches referenced by commits 250159a, 46336f4, 94134d7, 9ea8798, bc9db0d, bf750cf, c1e7351, and e033cbf3.
- Restrict access to /dev/vcsa* and console font ioctls to trusted administrators by enforcing default root:tty ownership and 0600 permissions.
- Prioritize patching multi-tenant hosts, shared workstations, and any system where untrusted local users can reach the virtual console.
Patch Information
The fix clamps the glyph index in bit_cursor() to vc_font.charcount after masking, matching the existing contract used by bit_putcs_aligned() and bit_putcs_unaligned(). The change completes the earlier partial remediation in commit 18c4ef4e765a. Patch sets are available in the mainline and stable branches via the Kernel Git Commit 250159a, Kernel Git Commit 46336f4, Kernel Git Commit 94134d7, Kernel Git Commit 9ea8798, Kernel Git Commit bc9db0d, Kernel Git Commit bf750cf, Kernel Git Commit c1e7351, and Kernel Git Commit e033cbf3.
Workarounds
- Blacklist or unload framebuffer console drivers on servers that do not require a graphical console, forcing text-mode VGA where possible.
- Remove world or group write access from /dev/vcsa* and disable the CAP_SYS_TTY_CONFIG capability for unprivileged users.
- Disable console font switching for standard users by restricting KDFONTOP, PIO_FONT, and PIO_FONTX ioctls through mandatory access control policies such as SELinux or AppArmor.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
