CVE-2026-31742

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vt: discard stale unicode buffer on alt screen exit after resize

When enter_alt_screen() saves vc_uni_lines into vc_saved_uni_lines and

sets vc_uni_lines to NULL, a subsequent console resize via vc_do_resize()

skips reallocating the unicode buffer because vc_uni_lines is NULL.

However, vc_saved_uni_lines still points to the old buffer allocated for

the original dimensions.

When leave_alt_screen() later restores vc_saved_uni_lines, the buffer

dimensions no longer match vc_rows/vc_cols. Any operation that iterates

over the unicode buffer using the current dimensions (e.g. csi_J clearing

the screen) will access memory out of bounds, causing a kernel oops:

BUG: unable to handle page fault for address: 0x0000002000000020

RIP: 0010:csi_J+0x133/0x2d0

The faulting address 0x0000002000000020 is two adjacent u32 space

characters (0x20) interpreted as a pointer, read from the row data area

past the end of the 25-entry po

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References