CVE-2026-74635

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read issue exists in the Linux kernel's fbdev component. The bit cursor() function fetches a glyph under the cursor using a value obtained from scr readw(), which may exceed the current font's glyph count. This can be triggered via the vcs write() function in vc screen.c by writing an arbitrary 16-bit value to the /dev/vcsa endpoint. Additionally, switching from a font with 512 glyphs to one with 256 glyphs can leave stale screen data with high bits set, leading to the same out-of-bounds access. The issue occurs when the glyph index is not properly clamped to vc font.charcount before indexing font data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.