{"id":"CVE-2026-98838","kind":"vulnerability","aliases":["CVE-2026-98838"],"related":[],"title":"Linux kernel: DEC alignment test on background console overflows framebuffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvt: skip screen update for DEC alignment test on backgroup consoles\n\n[BUG]\nRecently, we encountered a KASAN warning as follows:\n\nBUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0x11f/0x140\nRead of size 1 at addr ff1100015fd9f6a4 by task tty_fbcon_oob/1239\nCPU: 7 UID: 0 PID: 1239 Comm: tty_fbcon_oob Not tainted 7.3.0-rc1 #100 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014\nCall Trace:\n <TASK>\n ...\n kasan_report+0xf0/0x120\n fb_pad_aligned_buffer+0x11f/0x140\n ccw_putcs+0x86c/0xa80\n fbcon_putcs+0x338/0x410\n do_update_region+0x21d/0x450\n do_con_write+0x1e0e/0x4880\n con_write+0x13/0x80\n n_tty_write+0x374/0x1010\n file_tty_write.isra.0+0x404/0x7a0\n ...\n\nreproduce:\n1) open /dev/tty0, set a KDFONTOP ioctl with op.op = KD_FONT_OP_SET,\nop.width = 8 and op.height = 16 (visible VC1)\n2) open /dev/tty1, set a KDFONTOP ioctl with op.op = KD_FONT_OP_SET,\nop.width = 28 and op.height = 24 (invisible VC2)\n3) echo 3 > /sys/devices/virtual/graphics/fbcon/rotate_all\n4) write EShash8(esc hash8) to tty1\n\n[CAUSE]\nAll VCs render to the framebuffer. setfont only modifies the target VC's\nfont without resizing the framebuffer backing buffer (par->rotated.buf);\nthe buffer is only resized for the visible VC\n(fbcon_do_set_font -> ... -> vc_do_resize -> update_screen). This relies on\nthe con_should_update() check performed before every update_region().\n\nHowever, the ESC # 8 path (do_con_trol -> do_update_region) omits the\ncon_should_update() check. After changing the font size of an invisible VC,\ndo_update_region() fills using the new font size against a buffer that was\nnever resized, causing an out-of-bounds access.\n\n[FIX]\nOnly push the update when the console is visible and not blanked, add\nthe con_should_update() check in the do_con_trol() like every other call\nsite of do_update_region() (update_region(), invert_screen(), ...).","summary":"The Linux kernel's virtual terminal code can write past a framebuffer buffer when the ESC # 8 screen-alignment test runs on a background console whose font size was changed. The out-of-bounds access can be triggered from a local terminal by a user who can open tty devices and set console fonts.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fbcon","linux-kernel","runtime","self-hosted"],"not_affected_if":["no-framebuffer-console"],"how_to_check":"- Run `uname -r` and compare against the kernel release that contains the upstream fix for CVE-2026-98838 (unknown in the sources)\n- Check whether the kernel contains the fix by searching the kernel git log for \"skip screen update for DEC alignment test\" (unknown in the sources)","fix":"- Update the Linux kernel to a release that includes the upstream commit for CVE-2026-98838 (version unknown in the sources)\n- Distributions: apply the vendor kernel update when published (unknown in the sources)","status":"open","published_at":"2026-10-18T16:17:38+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:15+00:00","updated_at":"2026-10-25T05:13:15+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:13:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit for CVE-2026-98838 (version unknown in the sources)\n- Distributions: apply the vendor kernel update when published (unknown in the sources)","reach":"local","title":"Linux kernel: DEC alignment test on background console overflows framebuffer","impact":"medium","summary":"The Linux kernel's virtual terminal code can write past a framebuffer buffer when the ESC # 8 screen-alignment test runs on a background console whose font size was changed. The out-of-bounds access can be triggered from a local terminal by a user who can open tty devices and set console fonts.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","fbcon","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user triggers out-of-bounds memory access in the kernel","analyst_note":"Check the NVD entry and the upstream kernel stable commit for the fixed versions and whether the bug reaches code execution, since the sources give no severity or version ranges.","how_to_check":"- Run `uname -r` and compare against the kernel release that contains the upstream fix for CVE-2026-98838 (unknown in the sources)\n- Check whether the kernel contains the fix by searching the kernel git log for \"skip screen update for DEC alignment test\" (unknown in the sources)","needs_analyst":true,"not_affected_if":["no-framebuffer-console"],"who_is_affected":"Systems running a Linux kernel with the virtual terminal and framebuffer console (fbcon) enabled, where local users can open terminal devices and change fonts. The sources describe a local trigger on the machine; headless servers without a framebuffer console are less likely to matter, but the sources do not say which configurations are confirmed vulnerable.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000746,"input_tokens":4155,"output_tokens":661,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':123C,171C,177C,181C,185C,190C,195C,199C,204C,208C '-2026':12A,15A '-4':164C '-98838':13A,16A '/dev/tty0':213C '/dev/tty1':233C '/sys/devices/virtual/graphics/fbcon/rotate_all':254C '0':140C,207C '04/01/2014':166C '1':128C,211C '1.17.0':163C '100':151C '1239':142C '16':228C '1996':161C '2':231C '24':248C '28':245C '3':251C,253C '4':255C '7':138C '7.3.0':149C '8':41B,225C,319C 'access':61B,364C 'add':378C 'addr':130C 'align':4A,44B,97C,121C,175C 'back':281C 'background':7A,49B 'backgroup':100C 'bio':162C 'blank':377C 'bound':60B,117C,363C 'buffer':37B,122C,176C,282C,286C,353C 'bug':102C,111C 'call':167C,392C 'caus':262C,358C 'ccw':179C 'chang':55B,334C 'check':310C,332C,383C 'code':31B 'comm':143C 'con':193C,197C,307C,322C,329C,380C,387C 'consol':8A,50B,79B,101C,372C 'cpu':137C 'cve':11A,14A 'dec':3A,96C 'devic':76B 'echo':252C 'encount':105C 'esc':40B,258C,318C 'eshash8':257C 'everi':313C,390C 'fb':119C,173C 'fbcon':17B,135C,145C,183C,294C 'fc41':165C 'ff1100015fd9f6a4':131C 'file_tty_write.isra':206C 'fill':345C 'fix':365C 'follow':86C,110C 'font':52B,80B,221C,241C,276C,297C,336C,349C 'framebuff':10A,36B,268C,280C 'full':153C 'hardwar':154C 'hash8':259C 'host':24B 'howev':316C 'i440fx':159C 'invert':400C 'invis':249C,340C 'ioctl':217C,237C 'kasan':107C,112C,169C 'kd':220C,240C 'kdfontop':216C,236C 'kernel':2A,20B,27B,84C 'like':389C 'linux':1A,19B,26B,83C 'linux-kernel':18B 'local':67B 'modifi':271C 'n':201C 'name':155C 'never':356C 'new':348C 'omit':327C 'oob':146C 'oob/1239':136C 'op':222C,242C 'op.height':227C,247C 'op.op':219C,239C 'op.width':224C,244C 'open':74B,212C,232C 'out-of-bound':57B,360C 'overflow':9A 'pad':120C,174C 'par':283C 'past':34B 'path':320C 'pc':158C 'perform':311C 'pid':141C 'piix':160C 'preempt':152C 'push':367C 'putc':180C,184C 'qemu':156C 'rc1':150C 'read':125C 'recent':103C 'region':189C,315C,326C,344C,397C,399C 'reli':304C 'render':265C 'report':170C 'reproduc':210C 'resiz':278C,289C,300C,357C 'resolv':90C 'rotated.buf':284C 'run':46B 'runtim':21B 'screen':43B,93C,302C,401C 'screen-align':42B 'self':23B 'self-host':22B 'set':78B,214C,223C,234C,243C,296C 'setfont':269C 'site':393C 'size':53B,127C,337C,350C 'skip':92C 'slab':114C 'slab-out-of-bound':113C 'standard':157C 'taint':148C 'target':273C 'task':133C 'termin':30B,68B 'test':5A,45B,98C 'trace':168C 'trigger':64B 'trol':323C,388C 'tti':75B,134C,144C,202C 'tty1':261C 'uid':139C 'updat':94C,188C,301C,309C,314C,325C,331C,343C,369C,382C,396C,398C 'use':346C 'user':71B 'vc':274C,293C,298C,341C 'vc1':230C 'vc2':250C 'vcs':264C 'virtual':29B 'visibl':229C,292C,374C 'vt':91C 'vulner':87C 'warn':108C 'whose':51B 'without':277C 'write':33B,194C,198C,203C,256C 'x11f/0x140':124C,178C 'x13/0x80':200C 'x1e0e/0x4880':196C 'x21d/0x450':191C 'x338/0x410':186C 'x374/0x1010':205C 'x404/0x7a0':209C 'x86c/0xa80':182C 'xf0/0x120':172C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the virtual terminal and framebuffer console (fbcon) enabled, where local users can open terminal devices and change fonts. The sources describe a local trigger on the machine; headless servers without a framebuffer console are less likely to matter, but the sources do not say which configurations are confirmed vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98838","severity":null,"published_at":"2026-10-18T16:17:38+00:00","modified_at":"2026-10-21T13:21:49+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}