Executive brief
A vulnerability in the Linux kernel's framebuffer device driver allows an attacker to read memory beyond the bounds of the glyph font table via a specially crafted cursor operation. An unprivileged user with access to device files like /dev/vcsa can trigger this out-of-bounds read, leading to information disclosure or potential kernel crashes. This affects the text-mode cursor rendering subsystem used by virtual consoles and terminal applications.
Technical details
The vulnerability is an out-of-bounds read in the bit_cursor() function of the fbdev bitblit driver (drivers/video/fbdev/core/bitblit.c). The function fetches glyph data by reading a character code from the screen buffer and using it to index into the font glyph table without bounds checking. The screen buffer value (read via scr_readw()) may contain character codes outside the valid glyph index range, especially when fonts are switched from 512-glyph to 256-glyph variants, or when arbitrary values are written via vcs_write() to /dev/vcsa. The attack requires local access to the device file (unprivileged user may have this permission) and involves writing malformed data via writev() to trigger cursor rendering. The fix applies glyph index clamping in bit_cursor() after attribute extraction and masking, consistent with similar mitigations already present in bit_putcs_aligned() and bit_putcs_unaligned(). A patch is available in commit 18c4ef4e765a (which addressed the putcs path) with follow-up fixes.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-22: disclosed