CVE-2026-46191

What it actually does

This is a local Linux kernel memory-corruption flaw in the framebuffer console rotation path. If font-buffer reallocation fails during console rotation, the kernel can continue using an old buffer that is too small for the rotated font. Subsequent output of sufficiently high character codes to the rotated console can access memory out of bounds. The most likely technical outcomes are kernel memory disclosure or a kernel crash/panic; privilege escalation is not proven by the provided data but memory corruption in kernel context should still be treated as high risk on systems where the vulnerable framebuffer console path is reachable.

Why it matters to the business

An authenticated local user, process, or attacker with code execution on a Linux host may be able to crash the system or expose sensitive kernel memory if framebuffer console rotation is in use or can be triggered. This is most relevant to workstations, kiosks, embedded systems, appliances, and servers exposing local console/framebuffer functionality. It is not listed in CISA KEV, is not associated with ransomware use, has very low EPSS, and has no known mature public exploit in the provided data, so broad internet-scale exploitation is unlikely; however, kernel crashes can still cause operational outages and data exposure on affected systems.

How an attack unfolds

An attacker first obtains local execution with low privileges on an affected Linux system. They then reach the framebuffer console path and trigger console rotation under conditions where the rotated font-buffer reallocation fails, such as memory pressure or allocation failure. Because the vulnerable kernel retains the old undersized font buffer instead of clearing it, the attacker causes output of character codes large enough to index beyond that buffer. This results in out-of-bounds kernel memory access from the framebuffer console rendering path, potentially leading to information disclosure or a denial-of-service crash.

How to fix it

Update the Linux kernel to a vendor release that includes the upstream fbcon fix for clearing the rotated font buffer when reallocation fails. Because no exact fixed versions were provided, use distribution advisories and kernel package changelogs to identify patched builds for the affected product line. Where immediate patching is not possible, reduce exposure by disabling or avoiding framebuffer console rotation, limiting local shell access, restricting access to virtual terminals/framebuffer devices, disabling unnecessary framebuffer console functionality where operationally feasible, and applying standard kernel hardening options such as KASLR, hardened usercopy, slab freelist hardening, and panic/oops monitoring.

How to confirm the fix worked

Confirm that the running kernel package includes the vendor backport or upstream patch for the fbcon_rotate_font() failure-handling issue. Validate both the installed package version and the active booted kernel version, since Linux systems can have patched packages installed while still running an older kernel until reboot. Review vendor advisories, package changelogs, or source patches for references to clearing the font buffer when console rotation allocation fails. In test environments only, exercise framebuffer console rotation with kernel debugging tools such as KASAN enabled and verify that rotated-console output no longer produces out-of-bounds access reports, oopses, or panics.

Typical attack path

1. Gain local low-privileged access to an affected Linux system.
2. Identify that framebuffer console support and console rotation functionality are available or active.
3. Trigger console rotation while inducing or relying on font-buffer reallocation failure.
4. Print or cause display of high-enough character codes on the rotated console.
5. Abuse the resulting out-of-bounds access to leak kernel memory or crash the system.

How to detect it

Look for evidence of prior exploitation in kernel logs, crash dumps, panic records, and endpoint telemetry rather than network logs, because exploitation is local. Relevant sources include dmesg, journald kernel logs, /var/log/kern.log, /var/log/messages, persistent pstore/ramoops records, kdump/vmcore artifacts, KASAN reports, audit logs showing local terminal activity, and EDR records for processes interacting with virtual terminals or framebuffer devices. Focus on kernel oopses or panics involving fbcon, console rotation, font rendering, putcs routines, or slab/out-of-bounds reports shortly after local console activity. Absence of these artifacts does not prove the vulnerability was not exercised, because successful information disclosure may leave little or no reliable log evidence.

• fbcon_rotate_font
• fbcon
• rotate_font
• KASAN: slab-out-of-bounds
• KASAN: global-out-of-bounds
• BUG: KASAN
• kernel BUG
• Oops:
• general protection fault
• unable to handle kernel paging request
• Kernel panic
• putcs
• framebuffer console
• /dev/fb0
• /dev/fb1
• /dev/tty0
• /dev/tty1
• pstore
• ramoops
• vmcore

What your security team should do

• Inventory Linux systems that use framebuffer console, virtual terminals, rotated displays, kiosks, embedded displays, or appliance-style local consoles.
• Prioritize patching systems where untrusted users can obtain local shell access or interact with the local console/framebuffer.
• Apply vendor kernel updates and reboot systems into the patched kernel; confirm the running kernel version after reboot.
• If patching is delayed, disable or avoid framebuffer console rotation and restrict access to local console and framebuffer device interfaces where feasible.
• Monitor for kernel oops, panic, KASAN, or memory-corruption events referencing fbcon, rotated console rendering, or font-buffer handling.
• Treat unexplained local kernel crashes on affected systems as potentially security-relevant, especially if preceded by console/font/framebuffer activity.
• Because EPSS is low and there is no KEV or known mature exploit in the provided data, prioritize according to local exposure rather than emergency internet-facing response.