{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-90245",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-90245"
  ],
  "published": "2026-09-17T16:10:40Z",
  "summary": "fbdev: kyro: Validate overlay viewport coordinates",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: kyro: Validate overlay viewport coordinates\n\nThe overlay viewport end coordinates are computed from the viewport\norigin and dimensions using 32-bit unsigned arithmetic. Large input\nvalues can cause these calculations to wrap around before the resulting\ncoordinates are passed to SetOverlayViewPort().\n\nSetOverlayViewPort() packs the viewport coordinates into 16-bit\nregister fields. The X coordinates are additionally adjusted by +2\nand +1 before being written. Validate the coordinate calculations\nfor 32-bit wraparound and ensure that the adjusted coordinates fit\nwithin their 16-bit register fields before calling\nSetOverlayViewPort().\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.188",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-90245"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d8c1a9579cbd8f4ac5cbd5a10f1afb5ee64adf30"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2ac6e30a552e6f9932c21c865a5c69f40c8aef64"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/413d763439ba68e5d547538e6b6c7de97d5818a5"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/e8d4e4cf388daeb49704f3de10b203034f28eb90"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a6decd4e72fc5846d3b268bd085a2089213fd5ee"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/33e54e3e0b2ca959304e62c3d84f0ad49bbe1afe"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/7bf36dc23bcf3496dec274a46ae0aaff4961ea03"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/7b5c7bc55e13e7f5ac7b1eaf5c6d690389ea5ee3"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-09-17T16:10:40Z"
  }
}