CVE-2026-89806 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
The framebuffer size calculation `fb_size = linebytes * height` can overflow when both values are large (e.g., 46341 * 46341 > INT_MAX). Since linebytes and height are both int types, the multiplication is performed as int * int, which results in undefined behavior on overflow.
Use check_mul_overflow() to detect and prevent this overflow, consistent with the approach used in simpledrm.c and corebootdrm.c.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified within the Linux kernel's Direct Rendering Manager subsystem specifically affects the sysfb component when processing Open Firmware device tree data. This issue manifests during the calculation of framebuffer dimensions, where the system computes the total size required for video memory by multiplying the number of bytes per line with the vertical height of the display resolution. The core technical flaw lies in the use of signed 32-bit integers for both operands in this multiplication operation. When high-resolution displays are involved or when specific configuration parameters result in large values, such as dimensions approaching forty-six thousand pixels, the product exceeds the maximum positive value representable by a signed thirty-two-bit integer. This condition triggers an arithmetic overflow, which constitutes undefined behavior under standard C language specifications and POSIX guidelines for signed integer operations.
From a security perspective, this flaw is classified under CWE-190, which denotes Integer Overflow or Wraparound. The consequences of such an overflow are severe because the resulting value may become negative due to two's complement representation rules. In subsequent memory allocation routines that rely on this calculated size, a negative or erroneously small positive integer can lead to insufficient buffer allocations. This discrepancy creates a classic heap-based buffer overflow scenario where data is written beyond the bounds of the allocated memory region. Such an exploit vector allows for potential arbitrary code execution, kernel privilege escalation, or system instability through denial of service conditions if malicious actors can influence the input parameters that determine line bytes and height values via device tree overlays or similar mechanisms.
The operational impact extends to system stability and integrity during boot processes where framebuffer initialization occurs. If the overflow results in a negative size being passed to memory allocation functions like kmalloc, it may cause immediate kernel panics due to invalid pointer arithmetic or out-of-bounds accesses later in the rendering pipeline. Even if the allocation succeeds with a truncated positive value, subsequent write operations by graphics drivers will corrupt adjacent kernel heap structures. This corruption can be leveraged by local attackers who have access to device tree modification capabilities or through compromised bootloader environments to gain unauthorized control over the operating system's execution flow.
To mitigate this vulnerability, developers implemented a robust check using the check_mul_overflow macro provided by the Linux kernel utility library. This function performs arithmetic operations in a safe manner that detects potential overflows before they occur and returns an error code if the result would exceed the limits of the target integer type. By integrating this validation step into sysfb.c, the system now rejects configurations that would lead to overflow conditions rather than proceeding with corrupted calculations. This approach aligns with established best practices seen in other kernel components such as simpledrm and corebootdrm, ensuring consistency across the graphics subsystem. The fix effectively neutralizes the CWE-190 weakness by enforcing strict bounds checking on critical arithmetic operations involved in resource allocation for display hardware initialization.