Junglewise Threat Intelligence

CVE-2026-89806: Linux kernel integer overflow in ofdrm framebuffer size calculation

CVE-2026-89806 · Severity: high · CVSS 8.4 · Published 2026-09-16

Executive brief

The Linux kernel's Open Firmware display driver contains an integer overflow vulnerability in framebuffer size calculations. When a system with an exceptionally large framebuffer (width × height product exceeding maximum integer size) attempts to initialize display hardware, the calculation can overflow, potentially causing the kernel to crash or become unstable. This affects systems using Open Firmware-based graphics initialization, particularly embedded and server systems.

Technical details

The vulnerability is an integer overflow in the ofdrm driver (drivers/gpu/drm/sysfb/ofdrm.c) where `fb_size = linebytes * height` is calculated using signed integer multiplication without overflow checking. When both linebytes and height are large values (e.g., 46341 × 46341 exceeds INT_MAX), the multiplication results in undefined behavior. The root cause is the lack of overflow detection in the framebuffer size calculation. An attacker with local access to manipulate framebuffer parameters or a malicious firmware could trigger this condition. The fix uses `check_mul_overflow()` to safely detect overflow before the calculation, preventing the vulnerability. Patches are available in kernel versions 6.2 and later.

Affected products

  • Linux Linux kernel 6.2 and later prior to patched version

Timeline

  • 2026-09-16: disclosed: Published by NVD
  • 2026-08-26: patched: Fix committed upstream by Thomas Zimmermann

References

Related threats