{"id":"CVE-2026-89806","revision":"fd824d668bb54332bef95755a9e4f326","records":[{"revision":"fd824d668bb54332bef95755a9e4f326","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89806","aliases":[],"title":"drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sysfb: ofdrm: Fix integer overflow in fb_size calculation\n\nThe framebuffer size calculation `fb_size = linebytes * height` can\noverflow when both values are large (e.g., 46341 * 46341 > INT_MAX).\nSince linebytes and height are both int types, the multiplication is\nperformed as int * int, which results in undefined behavior on overflow.\n\nUse check_mul_overflow() to detect and prevent this overflow, consistent\nwith the approach used in simpledrm.c and corebootdrm.c.","state":0,"publishedAt":"2026-09-16T10:30:39.548+00:00","modifiedAt":"2026-10-21T12:48:48.055+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/sysfb/ofdrm.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c8a17756c42581ba1a567d1dd3b69e8f5619a7d8\",\n                            \"lessThan\": \"0cec951667a624fafaca2695c46042f45851caec\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c8a17756c42581ba1a567d1dd3b69e8f5619a7d8\",\n                            \"lessThan\": \"711fe7949d37656a5586244afee9523b9e5e37e9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c8a17756c42581ba1a567d1dd3b69e8f5619a7d8\",\n                            \"lessThan\": \"ded6ad826fe0fd059333d3a3b3e1742c8e45ff41\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c8a17756c42581ba1a567d1dd3b69e8f5619a7d8\",\n                            \"lessThan\": \"d9daf9a6e7a6f82ef338a09386eefc6807100d3f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c8a17756c42581ba1a567d1dd3b69e8f5619a7d8\",\n                            \"lessThan\": \"c6f48e59ece0123f6a11527ad4d89b21c2d65b87\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/sysfb/ofdrm.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/0cec951667a624fafaca2695c46042f45851caec","https://git.kernel.org/stable/c/711fe7949d37656a5586244afee9523b9e5e37e9","https://git.kernel.org/stable/c/ded6ad826fe0fd059333d3a3b3e1742c8e45ff41","https://git.kernel.org/stable/c/d9daf9a6e7a6f82ef338a09386eefc6807100d3f","https://git.kernel.org/stable/c/c6f48e59ece0123f6a11527ad4d89b21c2d65b87"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89806","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89806","identifiers":["CVE-2026-89806"]},"retained":false,"historicalAffected":[]}],"coverage":[]}