CVE-2024-26798

What it actually does

Use-after-free in fbcon font handling where failure of vc_resize() on the first fbcon_do_set_font() call leaves system font data unrestored, allowing later font_get() to dereference invalid memory.

Why it matters to the business

Local users can trigger kernel crashes and denial of service on affected Linux systems, with higher risk in environments using fault injection or untrusted local code; patch urgency is low given absence from known exploitation lists.

How an attack unfolds

An attacker with local access crafts a sequence that forces vc_resize() to fail during the initial font set operation, then invokes font_get() to trigger a page fault on freed font structures, demonstrated via Syzkaller with fault injection.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.15.151 or commit ae68f57df3335679653868fafccd8c88ef84ae98; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel version includes the fix, verify absence of the described restore logic bug in fbcon.c, and test that font operations no longer produce use-after-free faults under allocation pressure.

Typical attack path

1. Obtain local user access on a vulnerable kernel
2. Trigger fbcon_do_set_font() with a failing vc_resize() on first invocation
3. Call con_font_get or equivalent ioctl to dereference the stale font data
4. Cause kernel oops and potential system instability

How to detect it

Review kernel logs for oops messages referencing fbcon_get_font, con_font_get, or page faults at address fffffffffffffff8; correlate with processes performing vt_ioctl or font operations around the time of the crash.

• fbcon_get_font+0x229/0x800
• BUG: unable to handle page fault for address: fffffffffffffff8
• con_font_op+0x1fc/0xf20

What your security team should do

• Prioritize kernel updates on systems exposing framebuffer console to local users
• Monitor kernel crash reports for fbcon_get_font signatures
• Apply the patch or newer stable release within normal maintenance windows given low EPSS and no KEV listing