What is the CVSS score of CVE-2026-74635?

CVE-2026-74635 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-74635?

Within 24 hours, identify all Linux systems in the environment and determine which are running affected kernel versions prior to the patched release. Within 7 days, apply the latest kernel security updates provided by your Linux distribution vendor and schedule system reboots during maintenance windows. Within 30 days, verify that all critical and high-priority Linux systems have completed kernel updates by cross-referencing asset inventory against patch deployment records and audit logs.

Linux Kernel CVE-2026-74635

Q: Which versions of Linux Kernel are affected by CVE-2026-74635?

A high-severity vulnerability in the Linux kernel's virtual console framebuffer subsystem allows local attackers with group-level access to crash systems or read sensitive kernel memory.. A patch is available.

EUVD-2026-64572 HIGH

2026-08-22 Linux

GHSA-gcm2-cr9p-5jc7

Buffer Overflow Linux

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Obtain tty group membership on target system
Delivery

Open /dev/vcsa and write crafted 16-bit glyph index via writev()
Exploit

Kernel stores unchecked value in screen buffer via vcs_scr_writew()
Install

Cursor rendering calls bit_cursor() on the poisoned buffer entry
C2

Unclamped index computes out-of-bounds font data pointer
Execute

soft_cursor() performs OOB kernel memory read
Impact

Kernel crash (DoS) or kernel memory disclosure

Vulnerability Assessment

Exploitation Conditions	Two concrete conditions must both hold for exploitation: (1) The Linux framebuffer console (fbcon) must be active - the vulnerable code in drivers/video/fbdev/core/bitblit.c is only exercised when a framebuffer-based display driver is the active console, not in VGA text mode or on headless systems. (2) The attacker must have write access to /dev/vcsa or /dev/vcsaN (typically owned root:tty, mode 0660), which requires membership in the tty group - this is a non-default privilege on most server configurations but common on desktop installations. Exploitation is further bounded to kernel versions in the affected ranges listed above where the charcount clamp was absent from bit_cursor(). The passive trigger (font-switch path) requires local console access with ability to change fonts, raising the privilege bar to the level of a legitimate console user. Exploitation does not require network access, elevated root privileges, or any special hardware beyond an active framebuffer device.
Impact	The NVD CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as a high-severity local privilege escalation candidate, but the I:H component is not directly demonstrated by the described mechanism, which is a kernel OOB read. The A:H and C:H ratings are well-supported - a crafted /dev/vcsa write can crash the kernel and potentially leak adjacent kernel memory contents. Exploitation is bounded by two meaningful prerequisites: fbdev must be the active framebuffer console (not VGA text mode), and the attacker must hold tty group membership or equivalent. The EPSS score of 0.22% at the 13th percentile is consistent with a niche kernel subsystem bug discovered via fuzzing rather than targeted research. This vulnerability is not in CISA KEV. A Syzkaller reproducer is described in the advisory, lowering the barrier for researchers, but the specific hardware/config path (active framebuffer console) limits real-world exposure in typical headless server environments. The primary realistic risk is on desktop Linux systems or embedded devices running framebuffer consoles where non-root users are in the tty group.
Exploit ScenarioDerived	A local user with tty group membership opens /dev/vcsa and uses writev() to write a crafted 16-bit screen buffer entry containing a glyph index larger than the current font's charcount. When the kernel's framebuffer console next renders the cursor at that screen position, bit_cursor() reads the crafted index, fails to clamp it, and computes a pointer far past the end of the font data array; the subsequent 16-byte read in soft_cursor() triggers a KASAN global-out-of-bounds read, crashing the kernel or exposing adjacent kernel memory. A Syzkaller fuzzing reproducer for this precise call chain (writev → /dev/vcsa → vcs_write → bit_cursor → soft_cursor) is described in the advisory.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 25, 2026

Out-of-bounds memory read in the Linux kernel's fbdev bitblit subsystem allows a local attacker with tty group write access to /dev/vcsa to crash the kernel or disclose kernel memory by supplying an out-of-range glyph index through the virtual console screen interface. The root cause is a missing bounds check in bit_cursor() in drivers/video/fbdev/core/bitblit.c - a sibling function to bit_putcs_aligned() and bit_putcs_unaligned(), which already received the same clamp in commit 18c4ef4e765a. No public exploit has been released and EPSS of 0.22% (13th percentile) indicates very low active exploitation probability; this is not in CISA KEV.

RemediationAI

Upgrade to the nearest patched stable kernel version: 6.6.152, 5.10.265, 6.1.183, 6.12.104, 5.15.216, 6.18.45, 7.1.9, or 7.2 depending on the branch in use. Stable backport commits are available at https://git.kernel.org/stable/c/250159ace2dc53c1bdad267aa8da51b638748700 and related links in the references. If immediate kernel upgrade is not feasible, the primary compensating control is to restrict write access to /dev/vcsa* devices: remove non-essential users from the tty group (gpasswd -d <user> tty) to block the vcs_write() exploitation path. Note this does not address the passive font-switch trigger, which originates within the console subsystem itself and requires no /dev/vcsa write. On systems where the framebuffer console is not required (headless servers), unloading or blacklisting fbcon (echo 'blacklist fbcon' >> /etc/modprobe.d/blacklist.conf) eliminates the vulnerable code path entirely with no functional impact.

Affected VersionsENISA

Linux 6.6.117 <6.6.152

Linux 5.10.247 <5.10.265

Linux patch: 6.1.183

Linux 6.17.8 <6.18

Linux patch: 6.12.104

Linux patch: 5.15.216

Linux 6.1.159 <6.1.183

Linux 18c4ef4e765a798b47980555ed665d78b71aeadf <9ea879862e66e354e616028c31b39aa3eb6d35d8

Linux 18c4ef4e765a798b47980555ed665d78b71aeadf <bc9db0d879c655d5dfd8add32fd60f13e65d132c

Linux 9ba1a7802ca9a2590cef95b253e6526f4364477f <94134d70abf9273b70499d97d0adc9185ef21091

Linux patch: 6.6.152

Linux c12003bf91fdff381c55ef54fef3e961a5af2545 <bf750cfeacf4e47ac72dadc7f05839696efb8576

Linux 0998a6cb232674408a03e8561dc15aa266b2f53b <250159ace2dc53c1bdad267aa8da51b638748700

Linux 5.15.197 <5.15.216

Linux patch: 7.1.9

Linux 901f44227072be60812fe8083e83e1533c04eed1 <c1e7351767dd30fc574395c82121e4c67b882da3

Linux 6.12.58 <6.12.104

Linux 18c4ef4e765a798b47980555ed665d78b71aeadf <e033cbf3975a8465f879ebd5989dc35b04423a4d

Linux patch: 0

Linux 5.4.302 <5.5

Linux efaf89a75a29b2d179bf4fe63ca62852e93ad620

Linux db5c9a162d2f42bcc842b76b3d935dcc050a0eec <46336f476484f36145e5117e72d7b590f47433ee

Linux 6.18

Linux a10cede006f9614b465cf25609a8753efbfd45cc

Linux patch: 7.2

Linux patch: 5.10.265

Linux patch: 6.18.45

Affected Packages

euvd linux fix: 5.5, 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in drivers/video/fbdev/core/bitblit.c within the Linux kernel's framebuffer console (fbcon) subsystem. bit_cursor() computes a font data pointer as vc_font.data + ((c & charmask) * w * height), where c is read directly from the screen buffer via scr_readw() and charmask is 0x1ff when vc_hi_font_mask is set (enabling 512-glyph font mode). Critically, the screen buffer value is never validated against the actual font's charcount, which may be only 256 after a font switch. The /dev/vcsa* virtual console screen access interface (vc_screen.c, vcs_write()) permits writing arbitrary 16-bit values into the screen buffer without charcount validation, providing the attacker-controlled input path. A secondary trigger exists passively: switching from a 512-glyph to a 256-glyph font leaves stale high-bit characters in the screen buffer, which can then produce the same out-of-bounds pointer when the cursor moves over them. KASAN detects the corruption as a global-out-of-bounds read at soft_cursor()+0x378. The CPE cpe:2.3:a:linux:linux:* confirms broad scope across kernel versions. The fix extends the charcount clamp already present in bit_putcs_aligned() and bit_putcs_unaligned() to the cursor rendering path, completing the bounds-checking work from commit 18c4ef4e765a.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.1 HIGH

Local device access via tty group sets AV:L/PR:L; OOB read supports C:H and A:H but I:H is undemonstrated by the described mechanism.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Aug 25, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 22, 2026 - 16:01 EUVD

CVE Published

Aug 22, 2026 - 15:32 cve.org

HIGH 7.8

CVE Published

Aug 22, 2026 - 15:32 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fbdev: bitblit: bound-check glyph index in bit_cursor()

bit_cursor() fetches the glyph under the cursor with

c = scr_readw(vc_pos); src = vc_font.data + ((c & charmask) * w * height);

where charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer value comes directly from scr_readw() and may be larger than the current font's glyph count.

Syzkaller triggers this via vcs_write(). The Call Trace shows vcs_write() in vc_screen.c writing an arbitrary 16-bit value with writev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via vcs_scr_writew() without checking charcount. The stored value is later read in bit_cursor() in bitblit.c.

When the font is changed from a font with 512 glyphs to a font with 256 glyphs, the screen buffer can retain characters with the high bit set from the previous mode, which could also produce the same out-of-bounds access.

BUG: KASAN: global-out-of-bounds in soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70 Read of size 16 at addr ffff800086c57970

Call Trace: soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70 bit_cursor+0xa90/0x1108 drivers/video/fbdev/core/bitblit.c:365 fbcon_cursor+0x344/0x498 drivers/video/fbdev/core/fbcon.c:1427 hide_cursor+0xdc/0x2d0 drivers/tty/vt/vt.c:883 update_region+0x100/0x18c drivers/tty/vt/vt.c:669 vcs_write+0x8ec/0xaf0 drivers/tty/vt/vc_screen.c:685

bit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph index to vc_font.charcount. Apply the same clamp in bit_cursor() after extracting the attribute and masking, before indexing fontdata.

The fix completes the bounds checking started in commit 18c4ef4e765a ("fbdev: bitblit: bound-check glyph index in bit_putcs*"), which missed the cursor path.

This change should be safe because the clamp reuses the existing contract from fbcon: charcount is maintained under console_lock in con_font_set() and fbcon_font_set(), and hi_font_mask is cleared when switching from 512 to 256 glyphs. When stale screen data with high bits remains after a font switch, or when vcs_write() stores an arbitrary value, clamping the index to 0 prevents the out-of-bounds read without changing cursor semantics - the same fallback bit_putcs uses.

Executive ViewAI

Why It Matters

A high-severity vulnerability in the Linux kernel's virtual console framebuffer subsystem allows local attackers with group-level access to crash systems or read sensitive kernel memory. Although no active exploitation has been detected and a vendor patch is available, organizations should prioritize updates to mitigate potential availability and confidentiality impact.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 87% exploitable

Prevalence

Ubiquitous

Linux kernel underlies the majority of servers, cloud instances, and embedded devices globally

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back