Cloudanix VulnDB

CVE-2026-98838

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux handles text on hidden terminal screens can let a local user corrupt kernel memory and crash the system or possibly gain higher privileges.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing con_should_update() guard in the DEC alignment test (ESC # 8) path allows do_update_region() to write to a framebuffer backing buffer sized for a different font, producing a slab-out-of-bounds read/write in fb_pad_aligned_buffer when an invisible virtual console has a non-default font.

Why it matters to the business

Local users can trigger kernel memory corruption or crashes on systems that use framebuffer consoles, leading to denial of service or potential privilege escalation; the five-day-old flaw affects recent kernels and requires urgent patching on multi-user or shared Linux hosts.

How an attack unfolds

An attacker with a local TTY opens two virtual consoles, installs mismatched fonts via KDFONTOP on the invisible console, rotates the framebuffer, then writes the DEC alignment escape sequence to the invisible console; the omitted visibility check causes the kernel to render using the new font metrics against the old buffer size, corrupting adjacent slab memory.

How to fix it

Apply the upstream fix that adds the con_should_update() check before do_update_region() in do_con_trol(); rebuild and boot a patched kernel; until patches are available, restrict unprivileged access to virtual consoles and font ioctls via device permissions or SELinux/AppArmor policy.

How to confirm the fix worked

Boot the patched kernel, repeat the reproducer steps with two VCs and rotate_all, then confirm absence of KASAN slab-out-of-bounds reports and that fbcon_putcs and do_update_region paths now respect console visibility.

Typical attack path

  1. Obtain local shell and access to /dev/tty*
  2. Use KD_FONT_OP_SET on an invisible VC to install a larger font
  3. Issue rotate_all to force framebuffer rotation
  4. Write ESC # 8 to the invisible console
  5. Trigger out-of-bounds access in fb_pad_aligned_buffer

How to detect it

Search kernel logs for KASAN reports mentioning fb_pad_aligned_buffer, ccw_putcs, or do_update_region triggered by tty_fbcon_oob or similar processes; inspect audit logs for KDFONTOP ioctls followed by ESC # 8 writes on non-visible consoles.

  • KASAN: slab-out-of-bounds in fb_pad_aligned_buffer
  • tty_fbcon_oob
  • KD_FONT_OP_SET.*width = 28
  • rotate_all
  • ESC # 8 written to non-visible VC

What your security team should do

  • Prioritize kernel update on all multi-user or graphical Linux systems within the next 7 days
  • Audit and tighten permissions on /dev/tty* and KD_FONT_OP ioctls
  • Enable KASAN or similar debug options in test kernels to catch similar console-path bugs
  • Monitor vendor advisories for backported fixes in LTS branches

The record

In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles [BUG] Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0x11f/0x140 Read of size 1 at addr ff1100015fd9f6a4 by task tty_fbcon_oob/1239 CPU: 7 UID: 0 PID: 1239 Comm: tty_fbcon_oob Not tainted 7.3.0-rc1 #100 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 Call Trace: <TASK> ... kasan_report+0xf0/0x120 fb_pad_aligned_buffer+0x11f/0x140 ccw_putcs+0x86c/0xa80 fbcon_putcs+0x338/0x410 do_update_region+0x21d/0x450 do_con_write+0x1e0e/0x4880 con_write+0x13/0x80 n_tty_write+0x374/0x1010 file_tty_write.isra.0+0x404/0x7a0 ... reproduce: 1) open /dev/tty0, set a KDFONTOP ioctl with op.op = KD_FONT_OP_SET, op.width = 8 and op.height = 16 (visible VC1) 2) open /dev/tty1, set a KDFONTOP ioctl with op.op = KD_FONT_OP_SET, op.width = 28 and op.height = 24 (invisible VC2) 3) echo 3 > /sys/devices/virtual/graphics/fbcon/rotate_all 4) write EShash8(esc hash8) to tty1 [CAUSE] All VCs render to the framebuffer. setfont only modifies the target VC's font without resizing the framebuffer backing buffer (par->rotated.buf); the buffer is only resized for the visible VC (fbcon_do_set_font -> ... -> vc_do_resize -> update_screen). This relies on the con_should_update() check performed before every update_region(). However, the ESC # 8 path (do_con_trol -> do_update_region) omits the con_should_update() check. After changing the font size of an invisible VC, do_update_region() fills using the new font size against a buffer that was never resized, causing an out-of-bounds access. [FIX] Only push the update when the console is visible and not blanked, add the con_should_update() check in the do_con_trol() like every other call site of do_update_region() (update_region(), invert_screen(), ...).

Affected packages

Ecosystem Package Introduced Fixed