Linux Kernel Out-of-Bounds Access Vulnerability in fbdev Damage Handling

A vulnerability in the Linux kernel's framebuffer (fbdev) deferred I/O handling has been addressed. The issue was an out-of-bounds access caused by the damage handler incorrectly tracking non-existing scanlines as dirty, which could lead to accessing memory beyond the screen buffer size. This vulnerability arose because fbdev's deferred I/O could only monitor pages, and if the screen buffer ended near the start of a page, additional scanlines could be incorrectly assumed to be dirty. The vulnerability has been resolved by clipping the memory range to the actual size of the screen buffer.

Impact

Exploitation of this vulnerability could lead to out-of-bounds memory access, potentially causing undefined behavior or memory corruption.