In the Linux kernel, the following vulnerability has been resolved:
auxdisplay: line-display: fix OOB read on zero-length message_store()
linedisp_display() unconditionally reads msg[count - 1] before
checking whether count is zero, so a write of zero bytes to the
message sysfs attribute hits msg[-1]:
write(fd, "", 0);
-> message_store(..., buf, count=0)
-> linedisp_display(linedisp, buf, count=0)
-> msg[count - 1] == '\n' ; OOB read
The kernfs write buffer for that store is a 1-byte allocation
(kernfs_fop_write_iter() does kmalloc(len + 1) with len == 0),
so msg[-1] is a 1-byte read before the slab object. On a
KASAN-enabled kernel this trips an out-of-bounds report and
panics; on stock kernels it silently reads adjacent slab data
and, if that byte happens to be '\n', the following count--
wraps ssize_t 0 to -1 and is then passed to kmemdup_nul().
linedisp_display() is reached from the message_store() sysfs
callback (drivers/auxdisplay/line-display.c message attribute,
mode 0644) and from the in-tree initial-message setup with
count == -1, so the OOB path is only userspace-triggerable via
zero-byte writes; vfs_write() does not short-circuit on
count == 0 and kernfs_fop_write_iter() dispatches the store
callback regardless.
Guard the trailing-newline trim with a count check. The
existing if (!count) block then takes the clear-display path
unchanged.
Affects every auxdisplay driver that registers via
linedisp_register() / linedisp_attach(): ht16k33, max6959,
img-ascii-lcd, seg-led-gpio.
References
Configurations
Configuration 1 (hide)
|
History
30 Oct 2026, 14:27
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-125 | |
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
| References | () https://git.kernel.org/stable/c/197476b126010bac1b3199833c6966cd6f54c2a9 - Patch | |
| References | () https://git.kernel.org/stable/c/3859960daeb9b7b39b9847b5b0113bc6081eb735 - Patch | |
| References | () https://git.kernel.org/stable/c/6ad4f75ef9f3372fce8cad494e789ac6a5507bef - Patch | |
| References | () https://git.kernel.org/stable/c/8776032fe989a9b5fc77f2de5e03e4adb44c630e - Patch | |
| References | () https://git.kernel.org/stable/c/a7511dcd9dd4bc55d123f9b800c8a4ed2662e5c6 - Patch | |
| References | () https://git.kernel.org/stable/c/ca5b0781946d5083ceafa752141f47f085853620 - Patch |
Information
Published : 2026-07-19 16:17
Updated : 2026-10-30 14:27
NVD link : CVE-2026-63949
Mitre link : CVE-2026-63949
CVE.ORG link : CVE-2026-63949
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-125
Out-of-bounds Read