Out-of-Bounds Read Vulnerability in Linux Kernel's Framebuffer Console

CVE-2026-53402

What is CVE-2026-53402?

The Linux kernel's framebuffer console has a vulnerability that can lead to an out-of-bounds read and potential kernel memory disclosure. This issue arises in the fbcon_do_set_font() function when memory allocation fails, causing a failure in the rollback logic. Specifically, it neglects to restore the hi_font state, resulting in terminal desynchronization. The mismatch allows the virtual terminal subsystem to accept character indices beyond the typical limit, which can subsequently access the wrong memory segment and lead to unpredictable behavior or sensitive data exposure. A fix has been implemented to add the necessary rollback for the hi_font mask and screen buffer in case of errors.

References