{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-53068","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-06-09T07:44:35.382Z","datePublished":"2026-06-24T16:30:10.140Z","dateUpdated":"2026-08-05T12:33:02.612Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:33:02.612Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/komeda: fix integer overflow in AFBC framebuffer size check\n\nThe AFBC framebuffer size validation calculates the minimum required\nbuffer size by adding the AFBC payload size to the framebuffer offset.\nThis addition is performed without checking for integer overflow.\n\nIf the addition oveflows, the size check may incorrectly succed and\nallow userspace to provide an undersized drm_gem_object, potentially\nleading to out-of-bounds memory access.\n\nAdd usage of check_add_overflow() to safely compute the minimum\nrequired size and reject the framebuffer if an overflow is detected.\nThis makes the AFBC size validation more robust against malformed.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached from local userspace through DRM ioctls, specifically framebuffer creation with `DRM_IOCTL_MODE_ADDFB2` on a Komeda DRM device. It is not reachable by network or adjacent-only input.\nAC:L - The attacker controls the framebuffer dimensions, modifier, offset, and GEM handle inputs needed to trigger the integer overflow. No race or external timing condition is required.\nPR:L - The vulnerable `ADDFB2` path has no root, auth, or master ioctl flag, but it requires local access to the DRM device node and a valid GEM handle. Triggering hardware consumption of the framebuffer uses normal local DRM modeset privileges rather than init-namespace root.\nUI:N - An attacker with local DRM device access can issue the required ioctls directly. No separate victim action is required.\nS:U - The impact remains within the local kernel/device security authority. This is not a VM escape, guest-to-host boundary crossing, or demonstrated IOMMU isolation bypass.\nC:H - The overflow can allow an undersized GEM object to pass validation and cause the display engine to DMA-read outside the framebuffer allocation. Because this is an out-of-bounds read from system memory and is not tightly bounded, confidentiality is high.\nI:N - The reachable AFBC framebuffer use is a display source path, so the hardware consumes memory rather than writing to it. The writeback path rejects AFBC framebuffers through layer capability checks, so a direct out-of-bounds write was not established.\nA:H - Out-of-bounds DMA reads can trigger AXI/TBU/IOMMU faults or wedge the display pipeline, and on some deployments may escalate to a kernel-visible hardware fault. The issue can be triggered repeatedly from local userspace once the device is accessible."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c"],"versions":[{"version":"65ad2392dd6d1691db93e82b08d3311298b9d64a","lessThan":"a3a2a9bdc0f9c2d863a5a290cb2d4a565f7268e7","status":"affected","versionType":"git"},{"version":"65ad2392dd6d1691db93e82b08d3311298b9d64a","lessThan":"e27b58095d7d3ac72f230e318838dee956258460","status":"affected","versionType":"git"},{"version":"65ad2392dd6d1691db93e82b08d3311298b9d64a","lessThan":"02ff8a7d3d0eecc546b9ab4c07b3d7c65d485583","status":"affected","versionType":"git"},{"version":"65ad2392dd6d1691db93e82b08d3311298b9d64a","lessThan":"d8a541906860aa3519b1874780d933c766918a7c","status":"affected","versionType":"git"},{"version":"65ad2392dd6d1691db93e82b08d3311298b9d64a","lessThan":"8165e8b28fdf392c2c7412518d602b4f193812a8","status":"affected","versionType":"git"},{"version":"65ad2392dd6d1691db93e82b08d3311298b9d64a","lessThan":"fe1f80f8f6e8611ac6349b9d464e8750443390cf","status":"affected","versionType":"git"},{"version":"65ad2392dd6d1691db93e82b08d3311298b9d64a","lessThan":"872d923b852705054bc099af663da862fdc1097d","status":"affected","versionType":"git"},{"version":"65ad2392dd6d1691db93e82b08d3311298b9d64a","lessThan":"779ec12c85c9e4547519e3903a371a3b26a289de","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c"],"versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","status":"unaffected","versionType":"semver"},{"version":"5.10.258","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.141","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.91","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.33","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.10","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"5.10.258"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.6.141"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.12.91"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.18.33"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"7.0.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/a3a2a9bdc0f9c2d863a5a290cb2d4a565f7268e7"},{"url":"https://git.kernel.org/stable/c/e27b58095d7d3ac72f230e318838dee956258460"},{"url":"https://git.kernel.org/stable/c/02ff8a7d3d0eecc546b9ab4c07b3d7c65d485583"},{"url":"https://git.kernel.org/stable/c/d8a541906860aa3519b1874780d933c766918a7c"},{"url":"https://git.kernel.org/stable/c/8165e8b28fdf392c2c7412518d602b4f193812a8"},{"url":"https://git.kernel.org/stable/c/fe1f80f8f6e8611ac6349b9d464e8750443390cf"},{"url":"https://git.kernel.org/stable/c/872d923b852705054bc099af663da862fdc1097d"},{"url":"https://git.kernel.org/stable/c/779ec12c85c9e4547519e3903a371a3b26a289de"}],"title":"drm/komeda: fix integer overflow in AFBC framebuffer size check","x_generator":{"engine":"bippy-1.2.0"}}}}