CVE-2026-53402
Received Received - Intake

Out-of-Bounds Read in Linux Kernel fbcon

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() When fbcon_do_set_font() fails (e.g., due to a memory allocation failure inside vc_resize() under heavy memory pressure), it jumps to the `err_out` label to roll back the console state. However, the current rollback logic forgets to restore the `hi_font` state, leading to a severe state machine corruption. Earlier in the function, `set_vc_hi_font()` might be called to change `vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()` subsequently fails, the `err_out` path restores `vc_font.charcount` but entirely skips rolling back the `vc_hi_font_mask` and the screen buffer. This mismatch leaves the terminal in a desynchronized state. Because `vc_hi_font_mask` remains set, the VT subsystem will still accept character indices greater than 255 from userspace and write them to the screen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will then use these inflated indices to access the reverted, 256-character font array, leading to a deterministic out-of-bounds read and potential kernel memory disclosure. Fix this by adding the missing rollback logic for the `hi_font` mask and screen buffer in the error path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-53402
EUVD
EUVD-2026-45457

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the framebuffer console (fbcon) subsystem. When setting a font fails due to memory pressure, the error handling code fails to properly restore the console state. Specifically, it does not reset the hi_font state, causing a mismatch between the terminal's internal state and the screen buffer. This leads to out-of-bounds memory reads when processing user input.

Detection Guidance

This vulnerability is specific to the Linux kernel's framebuffer console (fbcon) and requires kernel-level detection. There are no direct network commands to detect it. Monitor kernel logs for fbcon-related errors or crashes, especially during high memory pressure scenarios. Check for out-of-bounds read warnings in dmesg or syslog.

Impact Analysis

An attacker with local access could exploit this to read sensitive kernel memory, potentially exposing passwords, encryption keys, or other confidential data. It may also cause system instability or crashes due to memory corruption.

Compliance Impact

This vulnerability is a kernel memory disclosure issue in the Linux fbdev subsystem. It does not directly relate to data protection standards like GDPR or HIPAA, as it involves low-level terminal rendering and memory corruption rather than unauthorized data access or privacy violations.

Mitigation Strategies

Apply the kernel patch that fixes the fbcon_do_set_font() error handling. Update to a patched kernel version if available. If immediate patching is not possible, disable fbcon by passing 'fbcon=map:0' to the kernel boot parameters to prevent the vulnerable code path from being triggered.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53402. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart