CVE-2026-98838

Received Received - Intake

Heap-Based Buffer Overflow in Linux Kernel Framebuffer Console

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles [BUG] Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0x11f/0x140 Read of size 1 at addr ff1100015fd9f6a4 by task tty_fbcon_oob/1239 CPU: 7 UID: 0 PID: 1239 Comm: tty_fbcon_oob Not tainted 7.3.0-rc1 #100 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 Call Trace: <TASK> ... kasan_report+0xf0/0x120 fb_pad_aligned_buffer+0x11f/0x140 ccw_putcs+0x86c/0xa80 fbcon_putcs+0x338/0x410 do_update_region+0x21d/0x450 do_con_write+0x1e0e/0x4880 con_write+0x13/0x80 n_tty_write+0x374/0x1010 file_tty_write.isra.0+0x404/0x7a0 ... reproduce: 1) open /dev/tty0, set a KDFONTOP ioctl with op.op = KD_FONT_OP_SET, op.width = 8 and op.height = 16 (visible VC1) 2) open /dev/tty1, set a KDFONTOP ioctl with op.op = KD_FONT_OP_SET, op.width = 28 and op.height = 24 (invisible VC2) 3) echo 3 > /sys/devices/virtual/graphics/fbcon/rotate_all 4) write EShash8(esc hash8) to tty1 [CAUSE] All VCs render to the framebuffer. setfont only modifies the target VC's font without resizing the framebuffer backing buffer (par->rotated.buf); the buffer is only resized for the visible VC (fbcon_do_set_font -> ... -> vc_do_resize -> update_screen). This relies on the con_should_update() check performed before every update_region(). However, the ESC # 8 path (do_con_trol -> do_update_region) omits the con_should_update() check. After changing the font size of an invisible VC, do_update_region() fills using the new font size against a buffer that was never resized, causing an out-of-bounds access. [FIX] Only push the update when the console is visible and not blanked, add the con_should_update() check in the do_con_trol() like every other call site of do_update_region() (update_region(), invert_screen(), ...).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98838

EUVD

EUVD-2026-103778

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	2.6.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves an out-of-bounds memory access in the framebuffer (fb) subsystem. It occurs when a font size is changed for an invisible virtual console (VC), causing the system to write data beyond the allocated buffer during screen updates. The issue stems from missing a safety check before updating the screen for certain control sequences like ESC # 8.

Detection Guidance

This vulnerability is specific to the Linux kernel's framebuffer console (fbcon) and requires local access to trigger. Detection involves checking kernel logs for KASAN slab-out-of-bounds errors related to fb_pad_aligned_buffer. Monitor dmesg or /var/log/kern.log for errors like 'BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer'.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or potential privilege escalation if exploited. An attacker with local access might trigger a kernel panic or memory corruption by manipulating font settings on invisible consoles, affecting system stability and security.

Compliance Impact

This vulnerability is a kernel memory corruption issue in the Linux framebuffer console subsystem. It does not directly relate to data privacy, access controls, or audit logging required by GDPR or HIPAA. Compliance impact would be indirect if the flaw enabled privilege escalation or denial of service in systems handling regulated data.

Mitigation Strategies

Apply the kernel patch that adds the con_should_update() check in do_con_trol(). Until patched, avoid using ESC #8 sequences or font operations on invisible virtual consoles. Monitor vendor advisories for updates.

Hi! I’m here to help you understand CVE-2026-98838. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70