Description

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation The framebuffer size calculation `fb_size = linebytes * height` can overflow when both values are large (e.g., 46341 * 46341 > INT_MAX). Since linebytes and height are both int types, the multiplication is performed as int * int, which results in undefined behavior on overflow. Use check_mul_overflow() to detect and prevent this overflow, consistent with the approach used in simpledrm.c and corebootdrm.c.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-09-16T11:16:45.703Z",
  "pubdate": "2026-09-16T11:16:45.703Z",
  "executiveSummary": "The Linux kernel's ofdrm framebuffer driver contains an integer overflow vulnerability within the fb_size calculation logic. The vulnerability arises from an unchecked multiplication of linebytes and height variables, both represented as signed integers. When these dimensions reach sufficiently large values, the multiplication operation exceeds the limits of a 32-bit signed integer, resulting in an overflow. This flaw, classified as an integer overflow (CWE-190), could potentially lead to undersized memory allocation for the framebuffer. If exploited, an attacker could trigger a heap-based buffer overflow by writing data beyond the allocated boundaries, leading to system instability, potential kernel memory corruption, or local privilege escalation. This vulnerability affects systems using the ofdrm component within the Linux kernel drm subsystem. Successful exploitation requires an attacker to possess the ability to influence or supply the framebuffer configuration parameters, typically occurring during the initial system boot phase or through specific kernel driver interfaces. Given the nature of this flaw, the risk is elevated for systems where framebuffer configurations are exposed to untrusted sources or device tree modifications.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of arithmetic operations during the framebuffer memory allocation phase in the ofdrm driver. The source code performs the calculation 'fb_size = linebytes * height' without performing bounds checking or using overflow-safe arithmetic primitives. Because both 'linebytes' and 'height' are defined as 'int' types, the C compiler treats the multiplication as a signed 32-bit integer operation. In scenarios where the product exceeds INT_MAX (2,147,483,647), the result wraps around to a small or negative value due to modular arithmetic behavior.\nThis calculation is critical because 'fb_size' is used as the basis for subsequent kernel memory allocation (e.g., via kmalloc or similar kernel allocators). If the overflow occurs, the kernel allocates a memory buffer significantly smaller than what is required to hold the full framebuffer image. Following the allocation, driver routines proceed to write video data into the framebuffer memory. Because the system believes the buffer is sufficiently sized based on the intended dimensions, but the actual allocated memory is truncated, the driver will perform out-of-bounds writes into adjacent kernel memory structures.\nThe attack flow typically involves a malicious user or an attacker capable of modifying the system's Device Tree (DT) or kernel parameters to provide abnormally large values for frame dimensions. By forcing the driver to process these manipulated values, an attacker can trigger the integer overflow, causing the allocation of a small buffer. As the framebuffer driver attempts to copy pixel data into the destination memory, it will overwrite adjacent heap memory regions. The post-exploitation impact includes the overwriting of sensitive kernel structures, pointers, or function pointers located in the heap, which can be leveraged to achieve arbitrary code execution or cause a kernel panic (Denial of Service).\nThis vulnerability is localized to the ofdrm component within the drm/sysfb subsystem. It represents a logic error common in low-level memory management where input validation is absent for critical arithmetic operations. The vulnerability is effectively mitigated by replacing standard integer multiplication with the check_mul_overflow() macro, which safely detects potential overflows and allows the kernel to return an error before an undersized memory allocation occurs, consistent with robust coding practices implemented in other DRM modules like simpledrm and corebootdrm."
}