CVE-2026-89806

drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation

State
Published
Severity
8.4 High
Published
Sep 16, 2026
Updated
Oct 21, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation

The framebuffer size calculation `fb_size = linebytes * height` can overflow when both values are large (e.g., 46341 * 46341 > INT_MAX). Since linebytes and height are both int types, the multiplication is performed as int * int, which results in undefined behavior on overflow.

Use check_mul_overflow() to detect and prevent this overflow, consistent with the approach used in simpledrm.c and corebootdrm.c.

Scores

CVSSScoreVectorSource
3.18.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c8a17756c42581ba1a567d1dd3b69e8f5619a7d8 to before 0cec951667a624fafaca2695c46042f45851caecAffected
  • c8a17756c42581ba1a567d1dd3b69e8f5619a7d8 to before 711fe7949d37656a5586244afee9523b9e5e37e9Affected
  • c8a17756c42581ba1a567d1dd3b69e8f5619a7d8 to before ded6ad826fe0fd059333d3a3b3e1742c8e45ff41Affected
  • c8a17756c42581ba1a567d1dd3b69e8f5619a7d8 to before d9daf9a6e7a6f82ef338a09386eefc6807100d3fAffected
  • c8a17756c42581ba1a567d1dd3b69e8f5619a7d8 to before c6f48e59ece0123f6a11527ad4d89b21c2d65b87Affected
LinuxLinux
  • 6.2Affected
  • before 6.2Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.112 through 6.12.*Not affected
  • 6.18.51 through 6.18.*Not affected
  • 7.2.5 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.