The Linux kernel fbdev subsystem's bitblit code had a vulnerability (CVE-2026-74635) where bit_cursor() did not properly bound-check the glyph index fetched from the screen buffer. The screen buffer value, obtained via scr_readw(), could be larger than the font's glyph count, especially after switching fonts from 512 to 256 glyphs or when arbitrary 16-bit values were written via vcs_write(). This led to a global out-of-bounds read detected by KASAN in soft_cursor(). The patch adds clamping of the glyph index in bit_cursor() to the font's charcount, completing the bounds checking already present in related functions. This prevents out-of-bounds memory access without changing cursor semantics.

The vulnerability allows an out-of-bounds read in kernel memory, which can cause kernel crashes or memory corruption. While no direct exploit or active exploitation is known, such memory safety issues can potentially be leveraged for denial of service or as a component in privilege escalation attacks. The issue is limited to the fbdev bitblit code path and involves virtual console font handling and screen buffer manipulation.

A fix has been applied to the Linux kernel to clamp the glyph index in bit_cursor(), preventing out-of-bounds reads. Users should update to a kernel version that includes this patch. Since this is a kernel code fix, no additional workarounds are indicated. Patch status is not explicitly stated in the input data; check the vendor advisory or Linux kernel stable release notes for the exact fixed version.