CVE-2026-98838

In the Linux kernel, the following vulnerability has been resolved:

vt: skip screen update for DEC alignment test on backgroup consoles

[BUG] Recently, we encountered a KASAN warning as follows:

BUG: KASAN: slab-out-of-bounds in fb pad aligned buffer+0x11f/0x140 Read of size 1 at addr ff1100015fd9f6a4 by task tty fbcon oob/1239 CPU: 7 UID: 0 PID: 1239 Comm: tty fbcon oob Not tainted 7.3.0-rc1 #100 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 Call Trace: ... kasan report+0xf0/0x120 fb pad aligned buffer+0x11f/0x140 ccw putcs+0x86c/0xa80 fbcon putcs+0x338/0x410 do update region+0x21d/0x450 do con write+0x1e0e/0x4880 con write+0x13/0x80 n tty write+0x374/0x1010 file tty write.isra.0+0x404/0x7a0 ...

reproduce:

[CAUSE] All VCs render to the framebuffer. setfont only modifies the target VC's font without resizing the framebuffer backing buffer (par->rotated.buf); the buffer is only resized for the visible VC (fbcon do set font -> ... -> vc do resize -> update screen). This relies on the con should update() check performed before every update region().

However, the ESC # 8 path (do con trol -> do update region) omits the con should update() check. After changing the font size of an invisible VC, do update region() fills using the new font size against a buffer that was never resized, causing an out-of-bounds access.

[FIX] Only push the update when the console is visible and not blanked, add the con should update() check in the do con trol() like every other call site of do update region() (update region(), invert screen(), ...).