CVE-2026-90245

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the fbdev kyro driver where overlay viewport end coordinates are calculated using 32-bit unsigned arithmetic. Large input values can lead to integer wraparound before the coordinates are passed to the SetOverlayViewPort() function. This function packs coordinates into 16-bit register fields, and X coordinates are further adjusted by +2 and +1. The lack of validation for 32-bit wraparound and 16-bit register field limits can lead to incorrect coordinate processing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.