CVE-2026-53402

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the err out label of the fbcon do set font() function within the fbdev component. When fbcon do set font() fails, such as during a memory allocation failure in vc resize(), the rollback logic fails to restore the hi font state. Specifically, if set vc hi font() was previously called to modify vc->vc hi font mask and the screen buffer, the error path restores vc font.charcount but neglects to roll back the vc hi font mask and the screen buffer. This desynchronization allows the VT subsystem to accept character indices greater than 255 from userspace. Subsequent calls to fbcon putcs() use these indices to access a reverted 256-character font array, resulting in a deterministic out-of-bounds read that could lead to kernel memory disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.