CVE-2026-53402

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

When fbcon_do_set_font() fails (e.g., due to a memory allocation failure

inside vc_resize() under heavy memory pressure), it jumps to the `err_out`

label to roll back the console state. However, the current rollback logic

forgets to restore the `hi_font` state, leading to a severe state machine

corruption.

Earlier in the function, `set_vc_hi_font()` might be called to change

`vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`

subsequently fails, the `err_out` path restores `vc_font.charcount`

but entirely skips rolling back the `vc_hi_font_mask` and the screen

buffer.

This mismatch leaves the terminal in a desynchronized state. Because

`vc_hi_font_mask` remains set, the VT subsystem will still accept

character indices greater than 255 from userspace and write them to the

screen buffer. Subsequent rendering calls (e.g., `fbcon_pu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References