CVE-2026-46209: Linux DRM Framebuffer Memory Corruption Vulnerability

Technical summary

CVE-2026-46209 is a buffer boundary validation bypass in the DRM (Direct Rendering Manager) subsystem. The vulnerability stems from inconsistent dimension calculations in drm_gem_fb_init_with_funcs(). This function uses truncating integer division when computing subsampled plane heights and widths, while the ioctl-level framebuffer_check() function uses DIV_ROUND_UP() to round dimensions up. For formats with vertical subsampling (vsub > 1), such as NV12, a 1-pixel-tall framebuffer incorrectly computes height as 0 in the GEM object size check. The subsequent expression (height - 1) underflows to UINT_MAX, causing integer overflow in min_size calculation. This results in a falsely small required size, permitting undersized GEM object allocation. When GPU hardware accesses the chroma plane, it performs out-of-bounds memory operations. The fix aligns both code paths by using drm_format_info_plane_width() and drm_format_info_plane_height() helper functions that consistently apply rounding.

Business impact

This vulnerability allows a local, unprivileged user to trigger out-of-bounds memory access via GPU operations. Exploitation enables read and write access to kernel memory beyond framebuffer bounds, potentially leading to privilege escalation, information disclosure, or denial of service. Systems relying on GPU virtualization or container isolation may be particularly at risk if user-facing GPU access is permitted. The impact is confined to local attack surface but carries high severity due to the combination of memory corruption and privileged execution context.

Affected systems

All Linux kernel versions containing the affected drm_gem_fb_init_with_funcs() function are potentially vulnerable. Verify the exact kernel versions from the official Linux kernel security advisory. The vulnerability affects any system running an unpatched kernel with graphics drivers using the DRM subsystem—this includes most desktop Linux distributions, embedded systems with GPU hardware, and cloud instances with GPU acceleration enabled.

Exploitability

Exploitation requires local system access and the ability to perform framebuffer operations, typically available to unprivileged users with GPU device access. No network attack vector exists. The vulnerability is triggered by crafting a framebuffer with specific dimension and format combinations (e.g., NV12 with 1-pixel height) that reliably trigger the integer underflow. Proof-of-concept development is feasible but requires graphics subsystem expertise. The CVSS score of 7.8 reflects local attack surface (AV:L), but the absence of special privileges (PR:L) and the direct path to memory corruption (C:H, I:H, A:H) elevate severity.

Remediation

Patch the Linux kernel to a version containing the fix that unifies plane dimension calculations. Ensure drm_gem_fb_init_with_funcs() uses the same DIV_ROUND_UP() rounding as framebuffer_check(). Verify the patched kernel version against the official Linux kernel advisories. Compile and deploy the patched kernel following your organization's standard kernel update procedures.

Patch guidance

Obtain the patched kernel from your distribution's security update channels or directly from kernel.org. Verify patches are signed and authentic. For distributions: Ubuntu, Fedora, Debian, and RHEL will release kernel updates through their security advisories—check your vendor's CVE database for specific version numbers. Apply patches during scheduled maintenance to minimize GPU service interruptions. Recompile kernel modules if necessary and test GPU functionality post-deployment.

Detection guidance

System logs may not directly indicate exploitation, but monitor for: (1) GPU error messages or driver crashes following framebuffer operations; (2) unexpected memory access violations in dmesg related to DRM; (3) userspace GPU applications receiving out-of-bounds memory access errors. Kernel Address Sanitizer (KASAN) builds will flag the underflow and out-of-bounds access. Network-based detection is not feasible; focus on host-level kernel monitoring and GPU driver state inspection.

Why prioritize this

Prioritize patching systems where unprivileged users have GPU device access or where containers/VMs expose GPU to tenants. Standalone workstations without GPU or systems where GPU access is restricted to privileged users face lower immediate risk. However, given the HIGH CVSS score and potential for privilege escalation, this should be scheduled urgently within standard patching cycles (days to weeks, not months).

Risk score, explained

The CVSS 3.1 score of 7.8 reflects: (1) Local attack vector only (AV:L), limiting exposure but not eliminating concern; (2) Low complexity attack requiring specific dimension/format combinations but no special tools; (3) Low privileges required—unprivileged user access to GPU is typical on Linux workstations and multi-tenant systems; (4) High impact across confidentiality, integrity, and availability due to unrestricted memory read/write and kernel crash potential. The vulnerability is not in the CISA KEV catalog, indicating no confirmed active exploitation in the wild at publication, but the attack surface remains significant in GPU-enabled environments.

Frequently asked questions