CVE-2026-63949

auxdisplay: line-display: fix OOB read on zero-length message_store()

Published Jul 19, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

auxdisplay: line-display: fix OOB read on zero-length message_store()

linedisp_display() unconditionally reads msg[count - 1] before
checking whether count is zero, so a write of zero bytes to the
message sysfs attribute hits msg[-1]:

write(fd, "", 0);

-> message_store(..., buf, count=0)
-> linedisp_display(linedisp, buf, count=0)
-> msg[count - 1] == '\n' ; OOB read

The kernfs write buffer for that store is a 1-byte allocation
(kernfs_fop_write_iter() does kmalloc(len + 1) with len == 0),
so msg[-1] is a 1-byte read before the slab object. On a
KASAN-enabled kernel this trips an out-of-bounds report and
panics; on stock kernels it silently reads adjacent slab data
and, if that byte happens to be '\n', the following count--
wraps ssize_t 0 to -1 and is then passed to kmemdup_nul().

linedisp_display() is reached from the message_store() sysfs
callback (drivers/auxdisplay/line-display.c message attribute,
mode 0644) and from the in-tree initial-message setup with
count == -1, so the OOB path is only userspace-triggerable via
zero-byte writes; vfs_write() does not short-circuit on
count == 0 and kernfs_fop_write_iter() dispatches the store
callback regardless.

Guard the trailing-newline trim with a count check. The
existing if (!count) block then takes the clear-display path
unchanged.

Affects every auxdisplay driver that registers via
linedisp_register() / linedisp_attach(): ht16k33, max6959,
img-ascii-lcd, seg-led-gpio.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7e76aece6f036cb7ada4858d6aa73825bfe22983`	affected	< ca5b0781946d5083ceafa752141f47f085853620
`7e76aece6f036cb7ada4858d6aa73825bfe22983`	affected	< 8776032fe989a9b5fc77f2de5e03e4adb44c630e
`7e76aece6f036cb7ada4858d6aa73825bfe22983`	affected	< 3859960daeb9b7b39b9847b5b0113bc6081eb735
`7e76aece6f036cb7ada4858d6aa73825bfe22983`	affected	< 197476b126010bac1b3199833c6966cd6f54c2a9
`7e76aece6f036cb7ada4858d6aa73825bfe22983`	affected	< 6ad4f75ef9f3372fce8cad494e789ac6a5507bef
`7e76aece6f036cb7ada4858d6aa73825bfe22983`	affected	< a7511dcd9dd4bc55d123f9b800c8a4ed2662e5c6

Linux

affected

Version	Status	Constraints
`5.16`	affected	—
`0`	unaffected	< 5.16
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc6::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[7e76aece6f036cb7ada4858d6aa73825bfe22983,ca5b0781946d5083ceafa752141f47f085853620)`	affected	code_commit	—
`[7e76aece6f036cb7ada4858d6aa73825bfe22983,8776032fe989a9b5fc77f2de5e03e4adb44c630e)`	affected	code_commit	—
`[7e76aece6f036cb7ada4858d6aa73825bfe22983,3859960daeb9b7b39b9847b5b0113bc6081eb735)`	affected	code_commit	—
`[7e76aece6f036cb7ada4858d6aa73825bfe22983,197476b126010bac1b3199833c6966cd6f54c2a9)`	affected	code_commit	—
`[7e76aece6f036cb7ada4858d6aa73825bfe22983,6ad4f75ef9f3372fce8cad494e789ac6a5507bef)`	affected	code_commit	—
`[7e76aece6f036cb7ada4858d6aa73825bfe22983,a7511dcd9dd4bc55d123f9b800c8a4ed2662e5c6)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.16`	affected	generic	—
`[0,5.16)`	unaffected	generic	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8903-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8904-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8905-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8906-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8903-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8905-2	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.126% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/197476b126010bac1b3199833c6966cd6f54c2a9
https://git.kernel.org/stable/c/3859960daeb9b7b39b9847b5b0113bc6081eb735
https://git.kernel.org/stable/c/6ad4f75ef9f3372fce8cad494e789ac6a5507bef
https://git.kernel.org/stable/c/8776032fe989a9b5fc77f2de5e03e4adb44c630e
https://git.kernel.org/stable/c/a7511dcd9dd4bc55d123f9b800c8a4ed2662e5c6
https://git.kernel.org/stable/c/ca5b0781946d5083ceafa752141f47f085853620
https://lore.kernel.org/linux-cve-announce/2026071954-CVE-2026-63949-7f56@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63949
https://www.cve.org/CVERecord?id=CVE-2026-63949

History

Oct 30, 2026 2:45 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:linux:linux_kernel:7.1:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc6::::::
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}`

Jul 27, 2026 8:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-20 CWE-200

Jul 21, 2026 11:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-200

Jul 21, 2026 12:15 PM Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026071954-CVE-2026-63949-7f56@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63949 https://www.cve.org/CVERecord?id=CVE-2026-63949

Jul 19, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: auxdisplay: line-display: fix OOB read on zero-length message_store() linedisp_display() unconditionally reads msg[count - 1] before checking whether count is zero, so a write of zero bytes to the message sysfs attribute hits msg[-1]: write(fd, "", 0); -> message_store(..., buf, count=0) -> linedisp_display(linedisp, buf, count=0) -> msg[count - 1] == '\n' ; OOB read The kernfs write buffer for that store is a 1-byte allocation (kernfs_fop_write_iter() does kmalloc(len + 1) with len == 0), so msg[-1] is a 1-byte read before the slab object. On a KASAN-enabled kernel this trips an out-of-bounds report and panics; on stock kernels it silently reads adjacent slab data and, if that byte happens to be '\n', the following count-- wraps ssize_t 0 to -1 and is then passed to kmemdup_nul(). linedisp_display() is reached from the message_store() sysfs callback (drivers/auxdisplay/line-display.c message attribute, mode 0644) and from the in-tree initial-message setup with count == -1, so the OOB path is only userspace-triggerable via zero-byte writes; vfs_write() does not short-circuit on count == 0 and kernfs_fop_write_iter() dispatches the store callback regardless. Guard the trailing-newline trim with a count check. The existing if (!count) block then takes the clear-display path unchanged. Affects every auxdisplay driver that registers via linedisp_register() / linedisp_attach(): ht16k33, max6959, img-ascii-lcd, seg-led-gpio.
Title		auxdisplay: line-display: fix OOB read on zero-length message_store()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/197476b126010bac1b3199833c6966cd6f54c2a9 https://git.kernel.org/stable/c/3859960daeb9b7b39b9847b5b0113bc6081eb735 https://git.kernel.org/stable/c/6ad4f75ef9f3372fce8cad494e789ac6a5507bef https://git.kernel.org/stable/c/8776032fe989a9b5fc77f2de5e03e4adb44c630e https://git.kernel.org/stable/c/a7511dcd9dd4bc55d123f9b800c8a4ed2662e5c6 https://git.kernel.org/stable/c/ca5b0781946d5083ceafa752141f47f085853620