Executive brief
The Linux kernel's Open Firmware display driver contains an integer overflow vulnerability in framebuffer size calculations. When a system with an exceptionally large framebuffer (width × height product exceeding maximum integer size) attempts to initialize display hardware, the calculation can overflow, potentially causing the kernel to crash or become unstable. This affects systems using Open Firmware-based graphics initialization, particularly embedded and server systems.
Technical details
The vulnerability is an integer overflow in the ofdrm driver (drivers/gpu/drm/sysfb/ofdrm.c) where `fb_size = linebytes * height` is calculated using signed integer multiplication without overflow checking. When both linebytes and height are large values (e.g., 46341 × 46341 exceeds INT_MAX), the multiplication results in undefined behavior. The root cause is the lack of overflow detection in the framebuffer size calculation. An attacker with local access to manipulate framebuffer parameters or a malicious firmware could trigger this condition. The fix uses `check_mul_overflow()` to safely detect overflow before the calculation, preventing the vulnerability. Patches are available in kernel versions 6.2 and later.
Affected products
- Linux Linux kernel 6.2 and later prior to patched version
Timeline
- 2026-09-16: disclosed: Published by NVD
- 2026-08-26: patched: Fix committed upstream by Thomas Zimmermann