CVE-2026-63949

A flaw was found in the Linux kernel's auxdisplay line-display subsystem. A local user can trigger an out-of-bounds read by writing a zero-length message to the message sysfs attribute. This occurs because the linedisp_display() function attempts to read a character from a zero-length buffer, leading to an out-of-bounds memory access. On kernels with Kernel Address Sanitizer (KASAN) enabled, this can cause a system panic, resulting in a denial of service. This vulnerability affects various auxdisplay drivers, including ht16k33, max6959, img-ascii-lcd, and seg-led-gpio.