The Linux kernel vulnerability CVE-2026-63949 involves an out-of-bounds read in the auxdisplay line-display driver. The linedisp_display() function unconditionally reads the last byte of a message buffer (msg[count - 1]) without verifying that count is non-zero. When a zero-length write occurs to the message sysfs attribute, this results in reading msg[-1], which is outside the allocated buffer. On kernels with KASAN enabled, this triggers a panic due to the out-of-bounds read. On standard kernels, it silently reads adjacent slab memory, which may cause unexpected behavior such as count wrapping to -1 and passing invalid parameters to kmemdup_nul(). The vulnerability is reachable only via zero-byte writes from userspace to the message sysfs attribute of affected auxdisplay drivers. The fix adds a guard to ensure the trailing newline trim only occurs if count is greater than zero.

This vulnerability can cause out-of-bounds memory reads in the kernel, potentially leading to kernel panics on KASAN-enabled systems or undefined behavior on standard kernels. It may allow reading unintended kernel memory adjacent to the allocated buffer. There is no indication of privilege escalation or remote code execution from the provided data. The vulnerability is triggered by zero-byte writes to a sysfs attribute, which requires local access.

A fix is available that adds a check on the count variable before accessing msg[count - 1] in linedisp_display(). Users should apply the official Linux kernel patch that guards the trailing-newline trim with a count check. Until patched, avoid writing zero-length messages to the message sysfs attribute of affected auxdisplay drivers. Monitor vendor advisories for the official patch and update accordingly.