Cloudanix VulnDB

CVE-2026-90245

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A calculation error in certain graphics hardware support code could let bad numbers reach the display hardware and cause problems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Integer wraparound in 32-bit unsigned viewport coordinate calculations allows invalid values to reach SetOverlayViewPort(), which packs them into 16-bit hardware register fields after small adjustments.

Why it matters to the business

May cause graphics subsystem instability or denial of service on systems using the kyro fbdev driver; low ecosystem prevalence limits widespread operational impact.

How an attack unfolds

An attacker supplies oversized origin or dimension values to the overlay viewport interface; arithmetic wraparound produces out-of-range coordinates that are written to hardware registers without validation.

How to fix it

Apply the kernel patch that adds 32-bit wraparound checks and 16-bit register field bounds validation before calling SetOverlayViewPort().

How to confirm the fix worked

Confirm the presence of coordinate validation logic that rejects values causing 32-bit wraparound or exceeding 16-bit register limits after the documented +1/+2 adjustments.

Typical attack path

  1. Identify a process or interface that can supply overlay viewport parameters
  2. Supply large unsigned 32-bit values for origin and dimensions
  3. Trigger coordinate computation that wraps before register packing
  4. Cause SetOverlayViewPort() to program invalid 16-bit fields

How to detect it

Review kernel logs and graphics driver traces for signs of invalid viewport register programming or related oops/panic messages; no specific threat actor campaigns are associated.

What your security team should do

  • Update to a kernel containing the viewport coordinate validation fix
  • Audit any userspace code that configures kyro overlay viewports for safe parameter ranges
  • Monitor for graphics-related crashes or hangs on affected hardware

The record

In the Linux kernel, the following vulnerability has been resolved: fbdev: kyro: Validate overlay viewport coordinates The overlay viewport end coordinates are computed from the viewport origin and dimensions using 32-bit unsigned arithmetic. Large input values can cause these calculations to wrap around before the resulting coordinates are passed to SetOverlayViewPort(). SetOverlayViewPort() packs the viewport coordinates into 16-bit register fields. The X coordinates are additionally adjusted by +2 and +1 before being written. Validate the coordinate calculations for 32-bit wraparound and ensure that the adjusted coordinates fit within their 16-bit register fields before calling SetOverlayViewPort(). Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected packages

Ecosystem Package Introduced Fixed