Executive brief
The Linux kernel's Kyro graphics driver processes viewport coordinate parameters without proper validation, allowing integer wraparound in coordinate calculations. An attacker with local access to the fbdev driver could supply specially crafted overlay viewport dimensions that cause coordinate values to wrap around, potentially resulting in out-of-bounds register writes or unexpected graphics rendering behavior affecting system stability.
Technical details
This is an integer wraparound vulnerability in the kyro fbdev driver's overlay viewport setting function. The vulnerable code computes overlay viewport end coordinates (right and bottom) using 32-bit unsigned addition without checking for overflow, and then packs these values into 16-bit register fields. An attacker can supply large width/height values that cause the addition operations to wrap around, resulting in small computed coordinates that bypass intended bounds checks. The SetOverlayViewPort() function then applies additional adjustments (+2 to X left, +1 to X right) before writing to hardware registers, potentially causing register corruption. The fix adds comprehensive validation: checking that input coordinates don't exceed U16_MAX before adjustment, detecting wraparound via unsigned comparison (right < x or bottom < y), and validating the adjusted coordinates fit in 16-bit fields before calling SetOverlayViewPort(). Patches were merged into kernel stable branches starting July 2026.
Affected products
- Linux Linux Kernel from 2.6.12 onwards until patched
Timeline
- 2026-09-17: disclosed: CVE-2026-90245 published
- 2026-07-24: patched: Fix committed upstream
- 2026-09-14: patched: Patch applied to stable kernel branches