CVE-2026-98838 Overview
CVE-2026-98838 is an out-of-bounds read vulnerability in the Linux kernel's virtual terminal (vt) subsystem. The flaw resides in the DEC alignment test (ESC # 8) escape sequence handler, which omits the con_should_update() visibility check before invoking do_update_region(). When a user changes the font size of an invisible virtual console (VC) using the KDFONTOP ioctl, subsequent escape sequence processing triggers a slab-out-of-bounds read in fb_pad_aligned_buffer through the fbcon_putcs path. The issue was detected by KASAN and reproduces reliably on affected kernels.
Critical Impact
Local unprivileged users can trigger a KASAN-flagged slab-out-of-bounds read in the kernel framebuffer console path, enabling denial of service and potential information disclosure from adjacent kernel heap memory.
Affected Products
- Linux kernel (upstream vt/fbcon subsystem)
- Distributions shipping kernel 7.3.0-rc1 and other pre-patch stable branches referenced in the fix commits
- Any system exposing /dev/tty* interfaces with framebuffer console enabled
Discovery Timeline
- 2026-10-18 - CVE-2026-98838 published to the National Vulnerability Database
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98838
Vulnerability Analysis
The Linux virtual terminal driver supports the DEC screen alignment test, invoked via the ESC # 8 escape sequence, which fills the console with uppercase E characters. The handler path do_con_trol -> do_update_region writes glyphs through fbcon_putcs and ultimately fb_pad_aligned_buffer. All virtual consoles share a single framebuffer backing buffer (par->rotated.buf), but that buffer is resized only when the visible VC changes font metrics.
When a user issues KDFONTOP with KD_FONT_OP_SET against an invisible VC, fbcon_do_set_font updates the VC's font dimensions without resizing the shared buffer. Normal rendering paths such as update_region() and invert_screen() guard against this condition with con_should_update(), which returns false for background consoles. The ESC # 8 path omitted this check, allowing a write using the new, larger font geometry against a buffer sized for the smaller visible font.
Root Cause
The root cause is a missing visibility and blanking check in the do_con_trol() handler for the DEC alignment test sequence. The function invokes do_update_region() unconditionally, bypassing the con_should_update() guard that every other call site enforces. Combined with the shared par->rotated.buf allocation lifecycle, which only tracks the active VC's font size, the handler reads past the end of the slab allocation when the invisible VC's font geometry exceeds the buffer's capacity.
Attack Vector
Exploitation requires local access to a /dev/tty* device. The reproducer opens two TTY devices, sets differing font sizes via KDFONTOP on each (one visible, one invisible), enables framebuffer rotation via /sys/devices/virtual/graphics/fbcon/rotate_all, and writes the ESC # 8 sequence to the invisible VC. The resulting out-of-bounds read occurs in kernel context during ccw_putcs and can be triggered by any user holding a file descriptor to the terminal device. Refer to the upstream commits for the complete reproduction sequence and fix details.
Detection Methods for CVE-2026-98838
Indicators of Compromise
- KASAN splat reports referencing slab-out-of-bounds in fb_pad_aligned_buffer in kernel logs or dmesg output
- Call traces containing ccw_putcs, fbcon_putcs, do_update_region, and do_con_write following TTY write activity
- Unexpected KDFONTOP ioctl invocations against background virtual consoles by non-graphical processes
Detection Strategies
- Monitor kernel ring buffer messages for KASAN or general protection fault signatures tied to the framebuffer console path
- Audit ioctl syscalls targeting /dev/tty* devices with KD_FONT_OP_SET from unexpected user contexts using auditd or eBPF probes
- Correlate processes writing escape sequences to TTYs they did not allocate, which is uncommon outside of exploit attempts
Monitoring Recommendations
- Enable CONFIG_KASAN on test and canary hosts to surface memory safety regressions early
- Forward kernel logs to a centralized SIEM and alert on BUG: KASAN and slab-out-of-bounds substrings
- Track kernel version inventory across the fleet to identify hosts still running pre-patch builds
How to Mitigate CVE-2026-98838
Immediate Actions Required
- Apply the stable kernel updates containing commits 0928ed9b, 0ee53081, 2fc4e71a, 985c000b, or ad06f731 as appropriate for your branch
- Reboot affected systems after patching to load the fixed kernel image
- Restrict access to /dev/tty* and framebuffer sysfs entries on multi-user systems until patches are deployed
Patch Information
The upstream fix adds the missing con_should_update() check inside do_con_trol() so the DEC alignment test skips rendering for background or blanked consoles. See the stable tree commits: Kernel Git Commit 0928ed9b, Kernel Git Commit 0ee53081, Kernel Git Commit 2fc4e71a, Kernel Git Commit 985c000b, and Kernel Git Commit ad06f731.
Workarounds
- Disable the framebuffer console (fbcon) where graphical TTY output is not required
- Limit TTY device permissions so untrusted users cannot open multiple virtual consoles or issue KDFONTOP ioctls
- Avoid writing /sys/devices/virtual/graphics/fbcon/rotate_all from unprivileged contexts and audit who can modify that attribute
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
