Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: In the bitPutcs function, the bound-check glyph index was derived from the character value masked by 0xff or 0x1ff. This may lead to reading beyond the end of the built-in font array, exceeding the actual number o...

SUSE CVE-2026-74635

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

CVE-2026-74635

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

AZL-97097 CVE-2026-74635 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

UBUNTU-CVE-2026-74635

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

CVE-2026-74635

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

CVE-2026-74635 fbdev: bitblit: bound-check glyph index in bit_cursor()

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

CVE-2026-74635

CVE-2026-74635 is an out-of-bounds read in the Linux kernel's fbdev subsystem, specifically in bit_cursor() (drivers/video/fbdev/core/bitblit.c). The function indexes font glyph data using a value from the screen buffer without bounds-checking it against the font's glyph count. A local user can t...

CVE-2026-74635 fbdev: bitblit: bound-check glyph index in bit_cursor()

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

EUVD-2026-64572

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

PT-2026-79640

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read issue exists in the Linux kernel's fbdev component. The bit cursor function fetches a glyph under the cursor using a value obtained from scr readw, which may exceed...

Linux Distros Unpatched Vulnerability : CVE-2026-74635

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos %NASLMINLEVEL 80900 C Tenable, Inc...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099764)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099764 advisory. In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitputcs bitputcsaligned/unaligned derived the glyph...

kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling

A flaw was found in the Linux kernel. A local attacker can exploit this vulnerability by providing a specially crafted font glyph index to the bitblit component. This can lead to an out-of-bounds read, potentially resulting in information disclosure or a denial of service...

kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling

A flaw was found in the Linux kernel. A local attacker can exploit this vulnerability by providing a specially crafted font glyph index to the bitblit component. This can lead to an out-of-bounds read, potentially resulting in information disclosure or a denial of service...

fbdev: bitblit: bound-check glyph index in bit_putcs*

...

SUSE CVE-2025-40322

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitputcs bitputcsaligned/unaligned derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the...

EUVD-2025-201623

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitputcs bitputcsaligned/unaligned derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the...

CVE-2025-40322

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitputcs bitputcsaligned/unaligned derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the...

CVE-2025-40322

The CVE-2025-40322 issue affects the Linux kernel fbdev font handling. The bound-check for glyph indices in bit_putcs_aligned() and bit_putcs_unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which could exceed the font’s glyph count and cause an out-of-bounds r...