01 Record

CVE-2026-74635

fbdev: bitblit: bound-check glyph index in bit_cursor()

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

fbdev: bitblit: bound-check glyph index in bit_cursor()

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.12% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 2.1% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Received. NVD last modified this record on 2026-10-16.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-08-22 15:32Z2 MO AGO

Last updated

2026-10-16 19:06Z12 DAYS AGO

Reserved

2026-08-15

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-125Out-of-bounds ReadBase

Data version

5.2

Document digest

2a5fca155e82a72793db48c60d2cadaa3587e1d418cf7e667f9c5988eaedd158

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux0998a6cb232674408a03e8561dc15aa266b2f53b to < 250159ace2dc53c1bdad267aa8da51b638748700, db5c9a162d2f42bcc842b76b3d935dcc050a0eec to < 46336f476484f36145e5117e72d7b590f47433ee, c12003bf91fdff381c55ef54fef3e961a5af2545 to < bf750cfeacf4e47ac72dadc7f05839696efb8576, 9ba1a7802ca9a2590cef95b253e6526f4364477f to < 94134d70abf9273b70499d97d0adc9185ef21091, 901f44227072be60812fe8083e83e1533c04eed1 to < c1e7351767dd30fc574395c82121e4c67b882da3, 18c4ef4e765a798b47980555ed665d78b71aeadf to < bc9db0d879c655d5dfd8add32fd60f13e65d132c, 18c4ef4e765a798b47980555ed665d78b71aeadf to < 9ea879862e66e354e616028c31b39aa3eb6d35d8, 18c4ef4e765a798b47980555ed665d78b71aeadf to < e033cbf3975a8465f879ebd5989dc35b04423a4d, a10cede006f9614b465cf25609a8753efbfd45cc, efaf89a75a29b2d179bf4fe63ca62852e93ad620, 5.10.247 to < 5.10.265, 5.15.197 to < 5.15.216, 6.1.159 to < 6.1.183, 6.6.117 to < 6.6.152, 6.12.58 to < 6.12.104, 5.4.302 to < 5.5, 6.17.8 to < 6.18, 6.18—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/250159ace2dc53c1bdad267aa8da51b638748700
git.kernel.orghttps://git.kernel.org/stable/c/46336f476484f36145e5117e72d7b590f47433ee
git.kernel.orghttps://git.kernel.org/stable/c/bf750cfeacf4e47ac72dadc7f05839696efb8576
git.kernel.orghttps://git.kernel.org/stable/c/94134d70abf9273b70499d97d0adc9185ef21091
git.kernel.orghttps://git.kernel.org/stable/c/c1e7351767dd30fc574395c82121e4c67b882da3
git.kernel.orghttps://git.kernel.org/stable/c/bc9db0d879c655d5dfd8add32fd60f13e65d132c
git.kernel.orghttps://git.kernel.org/stable/c/9ea879862e66e354e616028c31b39aa3eb6d35d8
git.kernel.orghttps://git.kernel.org/stable/c/e033cbf3975a8465f879ebd5989dc35b04423a4d

07 Fixed in

Debian 12

linux
Fixed in 6.1.187-1
linux-6.12
Fixed in 6.12.107-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.105-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.9-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.