CVE-2026-74635: In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_curs
Summary
A vulnerability exists in the Linux kernel's fbdev (framebuffer device) subsystem where the bit_cursor() function can read out-of-bounds memory when processing glyph (character) indices. The problem occurs because the function doesn't validate that a character index from the screen buffer is within the current font's available glyphs, which can happen when fonts are switched or when arbitrary values are written to /dev/vcsa (a device file for virtual console access).
Solution / Mitigation
Apply a bounds check to clamp the glyph index to vc_font.charcount in the bit_cursor() function, similar to existing checks already implemented in bit_putcs_aligned() and bit_putcs_unaligned(). This involves extracting the attribute and masking the value, then clamping the index before using it to access fontdata. The fix completes bounds checking from commit 18c4ef4e765a and prevents the out-of-bounds read by using index 0 as a fallback when clamping is needed, without affecting cursor behavior.
Vulnerability Details
EPSS: 0.0%
August 22, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-74635
First tracked: August 22, 2026 at 02:07 PM
Classified by LLM (prompt v3) · confidence: 95%