CVE-2026-74635 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, System administrators responsible for Linux systems, Security teams monitoring Linux systems, and operators of Linux-based infrastructure should be aware of this vulnerability and take necessary actions to prevent exploitation.

Why it matters

CVE-2026-74635 is a high-severity Linux kernel vulnerability that allows for global-out-of-bounds read in the soft_cursor function. It requires immediate attention from Linux kernel developers, maintainers, and system administrators to prevent potential sensitive information disclosure and system instability.

• Sensitive information disclosure is possible due to out-of-bounds memory access
• System crashes or instability may occur due to improper handling of font changes
• Verification of affected versions and application of patches is necessary to prevent exploitation
• Remediation requires updating to a patched Linux kernel version

Technical summary

The bit_cursor function in the Linux kernel's fbdev module does not properly check the glyph index, leading to a global-out-of-bounds read. This can be triggered by writing an arbitrary 16-bit value to /dev/vcsa via vcs_write(). The bug was introduced in the Linux kernel's fbdev module and has been resolved with a bound-check patch. The patch is available in the official Linux kernel repository. Linux kernel developers and maintainers should review and apply the provided patches to prevent potential exploitation. The vulnerability affects Linux kernel versions prior to the patched version.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Restrict access to /dev/vcsa to prevent arbitrary writes
• Monitor for unusual activity or errors related to the Linux kernel
• Verify the Linux kernel version and apply the patch if necessary
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported via syzkaller and has been resolved with a bound-check patch in the Linux kernel. The issue is exploitable via an arbitrary 16-bit value written to /dev/vcsa. The patch is available in the official Linux kernel repository. No known exploits have been reported. The CVE record was published on 2026-08-22T15:32:15.280Z and has not been modified since then. The vulnerability affects Linux kernel versions prior to the patched version.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.