CVE-2026-53402: Linux Kernel Information Disclosure Bug

CVE-2026-53402 Overview

CVE-2026-53402 is an out-of-bounds read vulnerability in the Linux kernel's framebuffer console (fbcon) subsystem. The flaw resides in the error handling path of fbcon_do_set_font() within the fbdev driver. When fbcon_do_set_font() fails during a font change (for example, when vc_resize() fails under memory pressure), the rollback logic at the err_out label restores vc_font.charcount but omits restoration of the vc_hi_font_mask state and the screen buffer. This desynchronization allows the virtual terminal subsystem to accept character indices greater than 255 and reference a reverted 256-character font array, producing a deterministic out-of-bounds read.

Critical Impact
A local, low-privileged user can trigger kernel memory disclosure via the virtual terminal font-setting interface, potentially exposing sensitive kernel data.

Affected Products

Linux kernel fbdev/fbcon subsystem (multiple stable branches, per upstream commit fixes)
Distributions shipping the affected fbcon code prior to backporting fixes 076b1aa, 3618a4c, 3981571, 8fdc8c2, a7a526f, ac56219, b5bb2c6, cb016bc
Systems exposing /dev/tty* and the KDFONTOP ioctl to unprivileged local users

Discovery Timeline

2026-07-19 - CVE-2026-53402 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-53402

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the fbcon_do_set_font() function of the Linux framebuffer console driver. During a font-setting operation, set_vc_hi_font() may be invoked to update vc->vc_hi_font_mask and mutate the screen buffer to accommodate fonts with more than 256 glyphs. If vc_resize() later fails, control transfers to the err_out label to roll back changes.

The rollback is incomplete. It restores vc_font.charcount but does not reset vc_hi_font_mask or the previously mutated screen buffer. The virtual terminal remains in a state where it advertises support for high-index glyphs while the underlying font table has been reverted to 256 entries.

Subsequent rendering paths such as fbcon_putcs() then index into the smaller font array using character values greater than 255. This reads adjacent kernel memory and may disclose that memory to the attacker through pixel data written to the framebuffer.

Root Cause

The root cause is a missing error-path rollback. The function tracks two related pieces of state (vc_font.charcount and vc_hi_font_mask, along with the screen buffer), but the error handler only reverts one. This state-machine inconsistency violates the invariant that the character index range must match the font array bounds.

Attack Vector

Exploitation requires local access with permission to open a virtual terminal device and issue the KDFONTOP/PIO_FONTX ioctl. An attacker induces the failure path by triggering memory pressure that causes vc_resize() to fail while loading a font with more than 256 glyphs. After the failed operation, writing high-index characters to the console causes the kernel to read beyond the font array. The vulnerability is described in upstream kernel commits, including Kernel Git Commit 076b1aa and Kernel Git Commit a7a526f.

Detection Methods for CVE-2026-53402

Indicators of Compromise

Unusual patterns of KDFONTOP or PIO_FONTX ioctl calls from non-root processes on /dev/tty* devices
Repeated font-set operations correlated with allocator failures or memory-pressure events in kernel logs
Unexpected framebuffer content or console glyph rendering anomalies following font ioctl activity

Detection Strategies

Audit kernel logs (dmesg) for vc_resize allocation failures adjacent to virtual terminal activity
Enable auditd rules on the ioctl syscall targeting TTY devices to capture font-manipulation attempts by unprivileged users
Correlate process telemetry showing non-privileged binaries invoking KDFONTOP with subsequent unusual reads from framebuffer devices

Monitoring Recommendations

Monitor loaded kernel version against the fixed commits listed in the kernel stable tree
Track processes that open /dev/tty* and /dev/fb* devices outside expected console utilities such as setfont and kbd
Alert on kernel out-of-bounds warnings if KASAN is enabled in test or staging environments

How to Mitigate CVE-2026-53402

Immediate Actions Required

Apply the upstream Linux kernel patches that add the missing hi_font mask and screen buffer rollback in the err_out path of fbcon_do_set_font()
Update to a distribution kernel that incorporates one of the fix commits (076b1aa, 3618a4c, 3981571, 8fdc8c2, a7a526f, ac56219, b5bb2c6, cb016bc)
Restrict access to virtual terminal devices for untrusted local users where feasible

Patch Information

The fix restores vc_hi_font_mask and the screen buffer in the error path of fbcon_do_set_font(), ensuring the terminal state remains consistent when vc_resize() fails. Patches are available across multiple stable branches. See Kernel Git Commit 076b1aa, Kernel Git Commit 3618a4c, Kernel Git Commit 3981571, Kernel Git Commit 8fdc8c2, Kernel Git Commit a7a526f, Kernel Git Commit ac56219, Kernel Git Commit b5bb2c6, and Kernel Git Commit cb016bc.

Workarounds

Remove or blacklist the fbcon module on servers that do not require a graphical console
Restrict permissions on /dev/tty* and /dev/fb* so that only privileged users can issue font-manipulation ioctls
Disable user-loadable console fonts by configuring the system to boot with fbcon=nodefer or by removing the setfont capability from unprivileged users

bash

# Configuration example: restrict access to console font ioctls

# Verify running kernel version
uname -r

# Blacklist fbcon on headless systems (add to /etc/modprobe.d/blacklist-fbcon.conf)
echo "blacklist fbcon" | sudo tee /etc/modprobe.d/blacklist-fbcon.conf

# Tighten permissions on virtual terminal devices
sudo chmod o-rw /dev/tty[0-9]*

# Audit rule to log font-manipulation ioctls
sudo auditctl -a always,exit -F arch=b64 -S ioctl -F path=/dev/tty0 -k fbcon_font