A missing bounds check in the Linux framebuffer console causes an out‑of‑bounds read when a font size is changed on an invisible virtual console and the ESC #8 escape sequence is processed. The read can expose kernel memory contents, corrupt pointers, or trigger a kernel panic. The vulnerability results in a local denial of service.

Linux kernel releases that include the framebuffer console code path described in the KASAN report, such as the 7.3.0‑rc1 kernel and prior stable releases that have not applied this fix.

The bug requires local access to a virtual console and the ability to issue a font‑setting ioctl followed by an ESC #8 sequence. A CVSS score of 4.4 and an EPSS score of < 1 % indicate that this flaw is classified as low‑to‑moderate severity with a very small probability of exploitation. Because the read occurs inside the kernel framebuffer console code, it can leak memory contents or corrupt pointers, potentially leading to a kernel panic. The vulnerability is not listed in the CISA KEV catalog, so no known exploitation campaigns are reported. The lack of a remote attack vector and the local requirement for console interaction mean that, without patching, the flaw cannot be used for privilege escalation, but it can be used to cause a denial of service.