CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

Synopsis

An integer underflow and wrap-around vulnerability exists in the Linux kernel's DRM GEM framebuffer subsystem, specifically in the drm_gem_fb_init_with_funcs() function. The bug is reachable locally by an authenticated user with at least a low-privilege account. Successful exploitation allows an attacker to read or write kernel memory beyond the bounds of a Graphics Execution Manager (GEM) object, enabling full disclosure, tampering, and potential service disruption. Patched-image rebuilds at the fix versions listed above are available on HarborGuard for environments running an affected kernel.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to a listening service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerable ioctl code path; no administrative credentials are needed.

• Victim interactionNot required

  No victim interaction is required; the attacker triggers the vulnerability directly through their own process.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race condition, memory layout knowledge, or other environmental pre-condition beyond the local session.

Blast Radius

• Reads arbitrary kernel memory beyond the bounds of the GEM object, exposing data from other processes or kernel structures such as credentials and session tokens.
• Writes arbitrary kernel memory beyond object bounds, allowing modification of kernel data structures and persisted process state.
• Corrupts GPU-accessible memory regions, which can crash the affected service or destabilize the kernel, causing a denial of service for all processes on the host.
• Combining out-of-bounds read and write primitives, a local attacker can escalate privileges on the host by overwriting kernel security controls.