CVE-2026-53068

Analyzed Analyzed - Analysis Complete

Integer Overflow in Linux Kernel AFBC Framebuffer Validation

Publication date: 2026-06-24

Last updated on: 2026-07-21

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/komeda: fix integer overflow in AFBC framebuffer size check The AFBC framebuffer size validation calculates the minimum required buffer size by adding the AFBC payload size to the framebuffer offset. This addition is performed without checking for integer overflow. If the addition oveflows, the size check may incorrectly succed and allow userspace to provide an undersized drm_gem_object, potentially leading to out-of-bounds memory access. Add usage of check_add_overflow() to safely compute the minimum required size and reject the framebuffer if an overflow is detected. This makes the AFBC size validation more robust against malformed. Found by Linux Verification Center (linuxtesting.org) with SVACE.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-21

Generated

2026-08-04

AI Q&A

2026-06-24

EPSS Evaluated

2026-08-02

NVD

CVE-2026-53068

EUVD

EUVD-2026-38936

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.141 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 5.3 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's drm/komeda component, specifically in the AFBC framebuffer size check. The issue is due to an integer overflow when calculating the minimum required buffer size by adding the AFBC payload size to the framebuffer offset without verifying if the addition overflows.

If an overflow occurs, the size check may incorrectly succeed, allowing userspace to provide an undersized drm_gem_object. This can potentially lead to out-of-bounds memory access.

The fix involves using a safe addition function, check_add_overflow(), to detect and reject any framebuffer sizes that cause an overflow, making the validation more robust against malformed inputs.

Impact Analysis

This vulnerability can lead to out-of-bounds memory access in the Linux kernel's graphics subsystem. Such memory access issues can cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges by exploiting the memory corruption.

Mitigation Strategies

The vulnerability has been resolved by adding a check for integer overflow in the AFBC framebuffer size validation within the Linux kernel. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Apply the latest Linux kernel updates or patches that address the drm/komeda integer overflow issue.
Avoid using vulnerable kernel versions that do not include the check_add_overflow() safeguard in the AFBC framebuffer size calculation.

Hi! I’m here to help you understand CVE-2026-53068. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70