Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-53402

fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() When fbcon_do_set_font() fails (e.g., due to a memory allocation failure inside vc_resize() under heavy memory pressure), it jumps to the `err_out` label to roll back the console state. However, the current rollback logic forgets to restore the `hi_font` state, leading to a severe state machine corruption. Earlier in the function, `set_vc_hi_font()` might be called to change `vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()` subsequently fails, the `err_out` path restores `vc_font.charcount` but entirely skips rolling back the `vc_hi_font_mask` and the screen buffer. This mismatch leaves the terminal in a desynchronized state. Because `vc_hi_font_mask` remains set, the VT subsystem will still accept character indices greater than 255 from userspace and write them to the screen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will then use these inflated indices to access the reverted, 256-character font array, leading to a deterministic out-of-bounds read and potential kernel memory disclosure. Fix this by adding the missing rollback logic for the `hi_font` mask and screen buffer in the error path.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 868749a7456dc48e93887a8474194e2ee6d6c21f to < cb016bcb40c81e7b19c4ae6143babb366dae8e20affected
  • ebd6f886aa2447fcfcdce5450c9e1028e1d681bb to < ac562193c36696513ae196171892e9338475c4bcaffected
  • a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 to < 3618a4c5b2591cfa83efe74f5b18c2d02b35c3f5affected
  • a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 to < a7a526fbc847f07ad3a503c7382189be5ab68574affected
  • a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 to < b5bb2c696e140c399cb874def2feedf61dee27d6affected
  • a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 to < 076b1aa65f77a49bce5a48a4a55a397cfcafa2b8affected
  • a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 to < 39815715cbcfabb16fc8c5f4a23deeda20f5df62affected
  • a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 to < 8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2affected
  • f08ccb792d3eaf1dc62d8cbf6a30d6522329f660affected
  • 5.10.249 to < 5.10.261affected
  • 5.15.64 to < 5.15.212affected
  • 5.19.6 to < 5.20affected

Linux Linux

Default version status: affected

  • 6.0affected
  • 0 to < 6.0unaffected
  • 5.10.261 to ≤ 5.10.*unaffected
  • 5.15.212 to ≤ 5.15.*unaffected
  • 6.1.178 to ≤ 6.1.*unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.96 to ≤ 6.12.*unaffected
  • 6.18.39 to ≤ 6.18.*unaffected
  • 7.1.3 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References