CVE-2026-63949

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the linedisp display() function within the auxdisplay line-display component. The issue occurs when a zero-byte write is performed on the message sysfs attribute, causing the function to read msg[count - 1] without verifying if count is zero. This results in a read of the byte immediately preceding the slab object. On kernels with KASAN enabled, this triggers a panic; on standard kernels, it may lead to the silent reading of adjacent slab data. If the read byte is a newline character, the count variable wraps from 0 to -1 and is subsequently passed to kmemdup nul(). This path is triggerable from userspace via zero-byte writes to the message attribute in drivers/auxdisplay/line-display.c. The issue affects drivers that register via linedisp register() or linedisp attach(), including ht16k33, max6959, img-ascii-lcd, and seg-led-gpio.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.