CVE-2026-74635

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

AZL-97097 CVE-2026-74635 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

EUVD-2026-64572

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

CVE-2026-74635

CVE-2026-74635 is an out-of-bounds read in the Linux kernel's fbdev subsystem, specifically in bit_cursor() (drivers/video/fbdev/core/bitblit.c). The function indexes font glyph data using a value from the screen buffer without bounds-checking it against the font's glyph count. A local user can t...

PT-2026-79640

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit cursor bit cursor fetches the glyph under the cursor with c = scr readwvc pos; src = vc font.data + c & charmask w height; where charmask is 0x1ff when vc hi font mask is set. The...

CLSA-2026-1773046740 kernel: Fix of 21 CVEs

i40e: fix IRQ freeing in i40evsirequestirqmsix error path CVE-2025-39911 - media: rc: fix races with imondisconnect CVE-2025-39993 - VMCI: fix race between vmcihostsetupnotify and vmcictxunsetnotify CVE-2025-38102 - partitions: mac: fix handling of bogus partition table CVE-2025-21772 - tracing:...