CVE-2026-89806

8.4 HIGH

Published 2026-09-16 · Updated 2026-09-16

AI risk analysis

Summary: This vulnerability arises from an integer overflow in the framebuffer size calculation, which can lead to undefined behavior when both linebytes and height are large values.
Exploitability: Exploitation requires both linebytes and height to be large values, making it moderately difficult. Precondition is the presence of large framebuffer configurations.
Blast radius: If exploited, this could lead to system instability or crashes, potentially allowing an attacker to gain control over the system.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the Linux kernel version 6.1.17 or later.

overflowkernelstability

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation The framebuffer size calculation `fb_size = linebytes * height` can overflow when both values are large (e.g., 46341 * 46341 > INT_MAX). Since linebytes and height are both int types, the multiplication is performed as int * int, which results in undefined behavior on overflow. Use check_mul_overflow() to detect and prevent this overflow, consistent with the approach used in simpledrm.c and corebootdrm.c.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.