EUVD-2026-80406
GHSA-2f2m-wrrx-qjxp
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Overflow inputs come from firmware/device-tree geometry not runtime user input, so PR:H and AC:H (specific large values); impact is chiefly an undersized-allocation crash, so A:H with limited C/I.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
The framebuffer size calculation fb_size = linebytes * height can overflow when both values are large (e.g., 46341 * 46341 > INT_MAX). Since linebytes and height are both int types, the multiplication is performed as int * int, which results in undefined behavior on overflow.
Use check_mul_overflow() to detect and prevent this overflow, consistent with the approach used in simpledrm.c and corebootdrm.c.
AnalysisAI
Signed integer overflow in the Linux kernel ofdrm (Open Firmware framebuffer) driver allows the framebuffer size computation fb_size = linebytes * height to wrap when both geometry values are large, resulting in an undersized framebuffer allocation and subsequent out-of-bounds memory handling inside the drm/sysfb subsystem. Exposure is confined to systems that actually bind the ofdrm driver, effectively Open Firmware/PowerPC-class platforms whose linebytes and height come from firmware or the boot device tree rather than from runtime user input, and the assessed vector (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H) reflects that a privileged actor able to influence platform firmware or the device tree is required, which is considerably more restrictive than the published 8.4/PR:N rating. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the affected system to use the ofdrm (Open Firmware framebuffer) driver - effectively OF/PowerPC-class hardware - AND the framebuffer geometry (linebytes and height, both int) supplied via Open Firmware/device tree to be large enough that linebytes*height exceeds INT_MAX. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a signed integer overflow in the Linux kernel's drm/sysfb ofdrm (Open Firmware framebuffer) driver: `fb_size = linebytes * height` is computed as int*int, so large geometry values (e.g. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.18.51, 7.2.5 or 7.3-rc2 (or later within the same branch), which contain the check_mul_overflow() fix; the individual stable fix commits are https://git.kernel.org/stable/c/ded6ad826fe0fd059333d3a3b3e1742c8e45ff41, https://git.kernel.org/stable/c/d9daf9a6e7a6f82ef338a09386eefc6807100d3f and https://git.kernel.org/stable/c/c6f48e59ece0123f6a11527ad4d89b21c2d65b87, with the CVE detail at https://nvd.nist.gov/vuln/detail/CVE-2026-89806. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Open Firmware/PowerPC-class systems that bind the ofdrm driver and confirm whether any are business-critical; restrict privileged local access and firmware or device tree modification to trusted administrators, since the assessed vector requires an authenticated, privileged actor. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today