CVE-2026-98838: vt: skip screen update for DEC alignment test on backgroup consoles
In the Linux kernel, the following vulnerability has been resolved:
vt: skip screen update for DEC alignment test on backgroup consoles
[BUG] Recently, we encountered a KASAN warning as follows:
BUG: KASAN: slab-out-of-bounds in fbpadalignedbuffer+0x11f/0x140 Read of size 1 at addr ff1100015fd9f6a4 by task ttyfbconoob/1239 CPU: 7 UID: 0 PID: 1239 Comm: ttyfbconoob Not tainted 7.3.0-rc1 #100 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 Call Trace: <TASK> ... kasanreport+0xf0/0x120 fbpadalignedbuffer+0x11f/0x140 ccwputcs+0x86c/0xa80 fbconputcs+0x338/0x410 doupdateregion+0x21d/0x450 doconwrite+0x1e0e/0x4880 conwrite+0x13/0x80 nttywrite+0x374/0x1010 filettywrite.isra.0+0x404/0x7a0 ...
reproduce: 1) open /dev/tty0, set a KDFONTOP ioctl with op.op = KDFONTOPSET, op.width = 8 and op.height = 16 (visible VC1) 2) open /dev/tty1, set a KDFONTOP ioctl with op.op = KDFONTOPSET, op.width = 28 and op.height = 24 (invisible VC2) 3) echo 3 > /sys/devices/virtual/graphics/fbcon/rotateall 4) write EShash8(esc hash8) to tty1
[CAUSE] All VCs render to the framebuffer. setfont only modifies the target VC's font without resizing the framebuffer backing buffer (par->rotated.buf); the buffer is only resized for the visible VC (fbcondosetfont -> ... -> vcdoresize -> updatescreen). This relies on the conshouldupdate() check performed before every updateregion().
However, the ESC # 8 path (docontrol -> doupdateregion) omits the conshouldupdate() check. After changing the font size of an invisible VC, doupdateregion() fills using the new font size against a buffer that was never resized, causing an out-of-bounds access.
[FIX] Only push the update when the console is visible and not blanked, add the conshouldupdate() check in the docontrol() like every other call site of doupdateregion() (updateregion(), invertscreen(), ...).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In the ESC # 8 handling path (do_con_trol), add the con_should_update() check before calling do_update_region(), so screen updates are pushed only when the console is visible and not blanked.
Event History
Frequently Asked Questions
Which systems are exposed to the reported out-of-bounds access?
The issue is triggered in a framebuffer-console setup with multiple virtual consoles that use different font dimensions. The documented sequence uses a visible VC with an 8x16 font, an invisible VC with a 28x24 font, and a non-default fbcon rotation setting.
What actions are needed to trigger the problem?
A reproducer changes fonts on two VCs using KDFONTOP, sets /sys/devices/virtual/graphics/fbcon/rotate_all to 3, then sends the DEC alignment test escape sequence (ESC # 8) to the background tty. An attacker would need the ability to perform those console, font, sysfs, and tty-write operations.
How can I identify a system that has hit this issue?
A KASAN-enabled kernel may report a slab-out-of-bounds read in fb_pad_aligned_buffer. The reported call trace includes ccw_putcs, fbcon_putcs, do_update_region, do_con_write, con_write, and n_tty_write.
What can be done if the fix cannot be deployed immediately?
Avoid the triggering combination: do not configure differing font sizes on visible and background virtual consoles while using rotate_all, and prevent DEC alignment test sequences from being written to background consoles. Reverting the rotation configuration or keeping VC font dimensions consistent avoids the documented reproducer.