CVE-2026-63949
Received Received - Intake

Out-of-Bounds Read in Linux Kernel auxdisplay Subsystem

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: auxdisplay: line-display: fix OOB read on zero-length message_store() linedisp_display() unconditionally reads msg[count - 1] before checking whether count is zero, so a write of zero bytes to the message sysfs attribute hits msg[-1]: write(fd, "", 0); -> message_store(..., buf, count=0) -> linedisp_display(linedisp, buf, count=0) -> msg[count - 1] == '\n' ; OOB read The kernfs write buffer for that store is a 1-byte allocation (kernfs_fop_write_iter() does kmalloc(len + 1) with len == 0), so msg[-1] is a 1-byte read before the slab object. On a KASAN-enabled kernel this trips an out-of-bounds report and panics; on stock kernels it silently reads adjacent slab data and, if that byte happens to be '\n', the following count-- wraps ssize_t 0 to -1 and is then passed to kmemdup_nul(). linedisp_display() is reached from the message_store() sysfs callback (drivers/auxdisplay/line-display.c message attribute, mode 0644) and from the in-tree initial-message setup with count == -1, so the OOB path is only userspace-triggerable via zero-byte writes; vfs_write() does not short-circuit on count == 0 and kernfs_fop_write_iter() dispatches the store callback regardless. Guard the trailing-newline trim with a count check. The existing if (!count) block then takes the clear-display path unchanged. Affects every auxdisplay driver that registers via linedisp_register() / linedisp_attach(): ht16k33, max6959, img-ascii-lcd, seg-led-gpio.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63949
EUVD
EUVD-2026-45722

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
linux_kernel auxdisplay *
linux_kernel ht16k33 *
linux_kernel max6959 *
linux_kernel img-ascii-lcd *
linux_kernel seg-led-gpio *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a zero-length write to a sysfs attribute triggers an out-of-bounds (OOB) read. The function linedisp_display() reads msg[count - 1] before checking if count is zero, causing it to access msg[-1]. On KASAN-enabled kernels, this causes a panic. On stock kernels, it may read adjacent slab data and incorrectly process a zero-byte write as a negative count, leading to unexpected behavior.

Detection Guidance

This vulnerability can be detected by checking for out-of-bounds read errors in the kernel logs, particularly on KASAN-enabled systems. Look for kernel panic or OOB read reports after writing zero bytes to the message sysfs attribute in auxdisplay drivers. Example command: dmesg | grep -i "OOB" or dmesg | grep -i "panicked"

Impact Analysis

The impact is limited to systems using affected auxdisplay drivers (ht16k33, max6959, img-ascii-lcd, seg-led-gpio). A local attacker could trigger a kernel panic on KASAN-enabled systems or cause undefined behavior on stock kernels by writing zero bytes to a specific sysfs attribute. This requires write access to the vulnerable sysfs file.

Compliance Impact

This vulnerability is a low-level kernel memory access issue that could lead to system instability or crashes. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory safety. The issue is limited to a specific sysfs attribute in auxdisplay drivers and requires local access to trigger.

Mitigation Strategies

Apply the Linux kernel patch that fixes the OOB read in linedisp_display(). Disable or unload affected auxdisplay drivers (ht16k33, max6959, img-ascii-lcd, seg-led-gpio) if not needed. Restrict write access to the message sysfs attribute to prevent zero-byte writes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63949. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart