{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-53402", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.403Z", "datePublished": "2026-07-19T12:02:01.795Z", "dateUpdated": "2026-08-17T04:50:55.659Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:50:55.659Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()\n\nWhen fbcon_do_set_font() fails (e.g., due to a memory allocation failure\ninside vc_resize() under heavy memory pressure), it jumps to the `err_out`\nlabel to roll back the console state. However, the current rollback logic\nforgets to restore the `hi_font` state, leading to a severe state machine\ncorruption.\n\nEarlier in the function, `set_vc_hi_font()` might be called to change\n`vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`\nsubsequently fails, the `err_out` path restores `vc_font.charcount`\nbut entirely skips rolling back the `vc_hi_font_mask` and the screen\nbuffer.\n\nThis mismatch leaves the terminal in a desynchronized state. Because\n`vc_hi_font_mask` remains set, the VT subsystem will still accept\ncharacter indices greater than 255 from userspace and write them to the\nscreen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will\nthen use these inflated indices to access the reverted, 256-character\nfont array, leading to a deterministic out-of-bounds read and potential\nkernel memory disclosure.\n\nFix this by adding the missing rollback logic for the `hi_font` mask\nand screen buffer in the error path." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached only through the KDFONTOP ioctl on a framebuffer-console virtual terminal (/dev/ttyN), which is a local syscall path with no network or physical-access vector.\nAC:L - An attacker who controls a session on an fbcon-backed VT can reliably trigger the bug by issuing a font-change ioctl with different dimensions and a 256↔512 glyph transition, then inducing vc_resize() failure through self-controlled memory pressure; no race or victim-dependent timing is required.\nPR:L - KDFONTOP font-set operations require only that the caller owns the controlling TTY (current->signal->tty == tty), which any unprivileged local user with a console or VT session has; CAP_SYS_TTY_CONFIG is not required on that path.\nUI:N - Exploitation requires only the attacker's own ioctl and memory-pressure actions on their TTY; no action by another user or administrator is needed.\nS:U - Impact is confined to kernel memory disclosure and potential kernel crash within the same kernel security authority; there is no VM escape, sandbox escape, or cross-security-boundary effect.\nC:H - The desynchronized hi_font_mask causes deterministic out-of-bounds reads from the kernel font glyph buffer during fbcon rendering (e.g., bit_cursor and rotated putcs paths), enabling disclosure of adjacent kernel memory.\nI:N - The flaw is an out-of-bounds read with console state desynchronization; it does not provide an arbitrary kernel write, code execution, or other data-modification primitive.\nA:H - Out-of-bounds reads from kernel font data can cause kernel page faults and oopses, consistent with the prior syzkaller-reported fbcon font/resize failure class that produced unhandled page faults." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/video/fbdev/core/fbcon.c" ], "versions": [ { "version": "868749a7456dc48e93887a8474194e2ee6d6c21f", "lessThan": "cb016bcb40c81e7b19c4ae6143babb366dae8e20", "status": "affected", "versionType": "git" }, { "version": "ebd6f886aa2447fcfcdce5450c9e1028e1d681bb", "lessThan": "ac562193c36696513ae196171892e9338475c4bc", "status": "affected", "versionType": "git" }, { "version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24", "lessThan": "3618a4c5b2591cfa83efe74f5b18c2d02b35c3f5", "status": "affected", "versionType": "git" }, { "version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24", "lessThan": "a7a526fbc847f07ad3a503c7382189be5ab68574", "status": "affected", "versionType": "git" }, { "version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24", "lessThan": "b5bb2c696e140c399cb874def2feedf61dee27d6", "status": "affected", "versionType": "git" }, { "version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24", "lessThan": "076b1aa65f77a49bce5a48a4a55a397cfcafa2b8", "status": "affected", "versionType": "git" }, { "version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24", "lessThan": "39815715cbcfabb16fc8c5f4a23deeda20f5df62", "status": "affected", "versionType": "git" }, { "version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24", "lessThan": "8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2", "status": "affected", "versionType": "git" }, { "version": "f08ccb792d3eaf1dc62d8cbf6a30d6522329f660", "status": "affected", "versionType": "git" }, { "version": "5.10.249", "lessThan": "5.10.261", "status": "affected", "versionType": "semver" }, { "version": "5.15.64", "lessThan": "5.15.212", "status": "affected", "versionType": "semver" }, { "version": "5.19.6", "lessThan": "5.20", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/video/fbdev/core/fbcon.c" ], "versions": [ { "version": "6.0", "status": "affected" }, { "version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.3", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.249", "versionEndExcluding": "5.10.261" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.64", "versionEndExcluding": "5.15.212" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.178" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.145" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.96" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.18.39" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.1.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "7.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19.6" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/cb016bcb40c81e7b19c4ae6143babb366dae8e20" }, { "url": "https://git.kernel.org/stable/c/ac562193c36696513ae196171892e9338475c4bc" }, { "url": "https://git.kernel.org/stable/c/3618a4c5b2591cfa83efe74f5b18c2d02b35c3f5" }, { "url": "https://git.kernel.org/stable/c/a7a526fbc847f07ad3a503c7382189be5ab68574" }, { "url": "https://git.kernel.org/stable/c/b5bb2c696e140c399cb874def2feedf61dee27d6" }, { "url": "https://git.kernel.org/stable/c/076b1aa65f77a49bce5a48a4a55a397cfcafa2b8" }, { "url": "https://git.kernel.org/stable/c/39815715cbcfabb16fc8c5f4a23deeda20f5df62" }, { "url": "https://git.kernel.org/stable/c/8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2" } ], "title": "fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()", "x_generator": { "engine": "bippy-1.2.0" } } } }