CVE-2026-98838 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
vt: skip screen update for DEC alignment test on backgroup consoles
[BUG]
Recently, we encountered a KASAN warning as follows:
BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0x11f/0x140 Read of size 1 at addr ff1100015fd9f6a4 by task tty_fbcon_oob/1239 CPU: 7 UID: 0 PID: 1239 Comm: tty_fbcon_oob Not tainted 7.3.0-rc1 #100 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 Call Trace: <TASK> ... kasan_report+0xf0/0x120 fb_pad_aligned_buffer+0x11f/0x140 ccw_putcs+0x86c/0xa80 fbcon_putcs+0x338/0x410 do_update_region+0x21d/0x450 do_con_write+0x1e0e/0x4880 con_write+0x13/0x80 n_tty_write+0x374/0x1010 file_tty_write.isra.0+0x404/0x7a0 ...
reproduce: 1) open /dev/tty0, set a KDFONTOP ioctl with op.op = KD_FONT_OP_SET, op.width = 8 and op.height = 16 (visible VC1) 2) open /dev/tty1, set a KDFONTOP ioctl with op.op = KD_FONT_OP_SET, op.width = 28 and op.height = 24 (invisible VC2) 3) echo 3 > /sys/devices/virtual/graphics/fbcon/rotate_all 4) write EShash8(esc hash8) to tty1
[CAUSE]
All VCs render to the framebuffer. setfont only modifies the target VC's font without resizing the framebuffer backing buffer (par->rotated.buf); the buffer is only resized for the visible VC (fbcon_do_set_font -> ... -> vc_do_resize -> update_screen). This relies on the con_should_update() check performed before every update_region().
However, the ESC # 8 path (do_con_trol -> do_update_region) omits the con_should_update() check. After changing the font size of an invisible VC, do_update_region() fills using the new font size against a buffer that was never resized, causing an out-of-bounds access.
[FIX]
Only push the update when the console is visible and not blanked, add the con_should_update() check in the do_con_trol() like every other call site of do_update_region() (update_region(), invert_screen(), ...).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel contains a vulnerability within the virtual terminal subsystem that results in an out-of-bounds memory access when handling specific DEC alignment test sequences on background consoles. This issue manifests as a Kernel Address Sanitizer warning indicating a slab-out-of-bounds read, specifically occurring during framebuffer padding operations triggered by console write routines. The root cause lies in an inconsistency in how screen updates are managed across different virtual consoles and display states. When the font size of an invisible or non-active virtual console is modified via ioctl calls such as KD_FONT_OP_SET, the underlying framebuffer backing buffer is not resized to accommodate the new dimensions because resizing logic is typically reserved for visible consoles during active screen updates.
The technical flaw arises from a missing conditional check in the control sequence handling path associated with ESC # 8 commands. While most code paths that invoke do_update_region include a con_should_update() guard to ensure the console is both visible and not blanked, this specific escape sequence handler bypasses that protection. Consequently, when an application writes data triggering this alignment test on a background console with a newly set larger font size, the kernel attempts to render text using dimensions that exceed the allocated buffer space. This leads to memory corruption or information disclosure depending on the surrounding heap layout and access patterns, as the system reads from addresses beyond the valid slab allocation boundaries defined for the framebuffer structure.
From an operational perspective, this vulnerability allows a local user with write access to a tty device to trigger kernel-level memory errors. Although exploitation typically requires specific conditions such as having multiple virtual consoles configured with differing font sizes and triggering the ESC # 8 sequence, it represents a significant stability risk that can lead to system crashes or potential privilege escalation if combined with other vulnerabilities. The issue highlights the importance of consistent state checking across all code paths interacting with shared kernel resources like framebuffers.
To mitigate this vulnerability, developers have implemented a fix by integrating the con_should_update() check into the do_con_trol function path responsible for handling control sequences. This ensures that screen updates are only pushed when the console is visible and not in a blanked state, aligning its behavior with other update regions such as invert_screen or standard character output operations. System administrators should apply kernel patches that include this fix to prevent out-of-bounds accesses. Additionally, adhering to principle of least privilege by restricting access to tty devices can reduce the attack surface for local users attempting to trigger these conditions.
This vulnerability aligns with CWE-125 Out-of-bounds Read and is categorized under improper input validation within kernel subsystems. In terms of MITRE ATT&CK mapping, it relates to techniques involving exploitation of software vulnerabilities through memory corruption, specifically targeting the operating system or drivers for execution impact. Maintaining up-to-date kernel versions and monitoring for KASAN warnings in production environments are critical steps in detecting and preventing such issues before they can be leveraged by malicious actors.