Executive brief
The Linux kernel's DRM (Direct Rendering Manager) fbdev-generic driver performs framebuffer writes without proper boundary checks, allowing write operations beyond allocated memory. An attacker or malicious application can trigger this vulnerability through framebuffer operations, causing kernel panics, system hangs, and denial of service on systems running affected GPU drivers like AST2400.
Technical details
The vulnerability is a classic out-of-bounds memory access in the drm_fbdev_generic_helper_fb_dirty() function and the underlying drm_fb_helper_memory_range_to_clip() helper. The root cause involves two factors: (1) framebuffer buffers are allocated in page-granular sizes to support mmap(), but the framebuffer size may not divide evenly into page boundaries; and (2) DIV_ROUND_UP() macro use introduces off-by-one errors in damage rectangle calculation. This causes computed damage rectangles to extend beyond the allocated shadow buffer, leading to memcpy_toio() operations writing past EOF. An attacker can trigger this via userspace write operations to the framebuffer device (e.g., through IGT fbdev tests or direct /dev/fb* writes), resulting in kernel memory corruption, system hangs, and denial of service. The vulnerability affects multiple DRM drivers using fbdev-generic emulation on systems with non-standard page sizes or high-resolution displays.
Affected products
- Linux Linux kernel drm/fbdev-generic subsystem
Timeline
- 2025-12-24: disclosed