CVE-2026-53402 - Vulnerability Details

- fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

Description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

When fbcon_do_set_font() fails (e.g., due to a memory allocation failure
inside vc_resize() under heavy memory pressure), it jumps to the `err_out`
label to roll back the console state. However, the current rollback logic
forgets to restore the `hi_font` state, leading to a severe state machine
corruption.

Earlier in the function, `set_vc_hi_font()` might be called to change
`vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`
subsequently fails, the `err_out` path restores `vc_font.charcount`
but entirely skips rolling back the `vc_hi_font_mask` and the screen
buffer.

This mismatch leaves the terminal in a desynchronized state. Because
`vc_hi_font_mask` remains set, the VT subsystem will still accept
character indices greater than 255 from userspace and write them to the
screen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will
then use these inflated indices to access the reverted, 256-character
font array, leading to a deterministic out-of-bounds read and potential
kernel memory disclosure.

Fix this by adding the missing rollback logic for the `hi_font` mask
and screen buffer in the error path.

Published: 2026-07-19

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel console font handling can cause the kernel to skip restoring a high‑font state during an error rollback. This mismatch allows the kernel to accept character indices beyond 255 and subsequently read from an out‑of‑bounds location in the 256‑character font array, potentially revealing kernel memory contents. The weakness, classified as an out‑of‑bounds read (CWE‑125), can undermine the confidentiality of kernel data.

Affected Systems

All Linux kernel builds are potentially affected. The vulnerability impacts the core console subsystem of the Linux kernel, regardless of distribution, and no specific kernel version numbers are provided in the CVE entry.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity, but the EPSS score of less than 1 % suggests few or no known exploits. Based on the description, it is inferred that an attacker would need local access to trigger the console font resize failure, potentially by applying memory pressure or requesting a high‑bit font change; thus the attack surface appears limited to local or privileged users. The vulnerability is not yet listed in CISA’s KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`868749a7456dc48e93887a8474194e2ee6d6c21f`	affected	< cb016bcb40c81e7b19c4ae6143babb366dae8e20
`ebd6f886aa2447fcfcdce5450c9e1028e1d681bb`	affected	< ac562193c36696513ae196171892e9338475c4bc
`a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24`	affected	< 3618a4c5b2591cfa83efe74f5b18c2d02b35c3f5
`a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24`	affected	< a7a526fbc847f07ad3a503c7382189be5ab68574
`a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24`	affected	< b5bb2c696e140c399cb874def2feedf61dee27d6
`a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24`	affected	< 076b1aa65f77a49bce5a48a4a55a397cfcafa2b8
`a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24`	affected	< 39815715cbcfabb16fc8c5f4a23deeda20f5df62
`a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24`	affected	< 8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2
`f08ccb792d3eaf1dc62d8cbf6a30d6522329f660`	affected	—
`5.10.249`	affected	< 5.10.261
`5.15.64`	affected	< 5.15.212
`5.19.6`	affected	< 5.20

Linux

affected

Version	Status	Constraints
`6.0`	affected	—
`0`	unaffected	< 6.0
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24,b5bb2c696e140c399cb874def2feedf61dee27d6)`	affected	code_commit	—
`[a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24,076b1aa65f77a49bce5a48a4a55a397cfcafa2b8)`	affected	code_commit	—
`[a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24,39815715cbcfabb16fc8c5f4a23deeda20f5df62)`	affected	code_commit	—
`[a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24,8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2)`	affected	code_commit	—
`868749a7456dc48e93887a8474194e2ee6d6c21f`	affected	code_commit	—
`ebd6f886aa2447fcfcdce5450c9e1028e1d681bb`	affected	code_commit	—
`f08ccb792d3eaf1dc62d8cbf6a30d6522329f660`	affected	code_commit	—
`[5.10.249,5.11)`	affected	semver	—
`[5.15.64,5.16)`	affected	semver	—
`[5.19.6,5.20)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.0`	affected	generic	—
`[0,6.0)`	unaffected	semver	—
`[6.12.96,6.13.0]`	unaffected	semver	—
`[6.18.39,6.19.0]`	unaffected	semver	—
`[7.1.3,7.2.0]`	unaffected	semver	—
`7.2-rc1`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that includes the commit restoring the hi_font mask in the error path (available in recent mainline releases).
Reboot the system after the kernel update to ensure the new console state logic is active.
If a kernel update cannot be applied immediately, avoid high‑bit console font changes or reduce memory pressure on the console subsystem to prevent the failure path from being exercised.

Generated by OpenCVE AI on July 30, 2026 at 22:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Debian DSA	DSA-6393-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00128.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/076b1aa65f77a49bce5a48a4a55a397cfcafa2b8
https://git.kernel.org/stable/c/3618a4c5b2591cfa83efe74f5b18c2d02b35c3f5
https://git.kernel.org/stable/c/39815715cbcfabb16fc8c5f4a23deeda20f5df62
https://git.kernel.org/stable/c/8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2
https://git.kernel.org/stable/c/a7a526fbc847f07ad3a503c7382189be5ab68574
https://git.kernel.org/stable/c/ac562193c36696513ae196171892e9338475c4bc
https://git.kernel.org/stable/c/b5bb2c696e140c399cb874def2feedf61dee27d6
https://git.kernel.org/stable/c/cb016bcb40c81e7b19c4ae6143babb366dae8e20
https://lore.kernel.org/linux-cve-announce/2026071958-CVE-2026-53402-a896@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53402
https://www.cve.org/CVERecord?id=CVE-2026-53402

History

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/3618a4c5b2591cfa83efe74f5b18c2d02b35c3f5 https://git.kernel.org/stable/c/a7a526fbc847f07ad3a503c7382189be5ab68574 https://git.kernel.org/stable/c/ac562193c36696513ae196171892e9338475c4bc https://git.kernel.org/stable/c/cb016bcb40c81e7b19c4ae6143babb366dae8e20

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026071958-CVE-2026-53402-a896@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53402 https://www.cve.org/CVERecord?id=CVE-2026-53402
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() When fbcon_do_set_font() fails (e.g., due to a memory allocation failure inside vc_resize() under heavy memory pressure), it jumps to the `err_out` label to roll back the console state. However, the current rollback logic forgets to restore the `hi_font` state, leading to a severe state machine corruption. Earlier in the function, `set_vc_hi_font()` might be called to change `vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()` subsequently fails, the `err_out` path restores `vc_font.charcount` but entirely skips rolling back the `vc_hi_font_mask` and the screen buffer. This mismatch leaves the terminal in a desynchronized state. Because `vc_hi_font_mask` remains set, the VT subsystem will still accept character indices greater than 255 from userspace and write them to the screen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will then use these inflated indices to access the reverted, 256-character font array, leading to a deterministic out-of-bounds read and potential kernel memory disclosure. Fix this by adding the missing rollback logic for the `hi_font` mask and screen buffer in the error path.
Title		fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/076b1aa65f77a49bce5a48a4a55a397cfcafa2b8 https://git.kernel.org/stable/c/39815715cbcfabb16fc8c5f4a23deeda20f5df62 https://git.kernel.org/stable/c/8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2 https://git.kernel.org/stable/c/b5bb2c696e140c399cb874def2feedf61dee27d6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:02:01.795Z

Updated: 2026-08-05T12:35:41.953Z

Reserved: 2026-06-09T07:44:35.403Z

Link: CVE-2026-53402

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-53402 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T22:30:06Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object