CVE-2026-53402

A flaw was found in the Linux kernel's framebuffer console (fbcon) component. When the fbcon_do_set_font() function fails, the system's error handling does not correctly restore the font state, leading to a desynchronized terminal. A local user can exploit this by providing character indices that cause an out-of-bounds read in the font array during rendering. This vulnerability can lead to the disclosure of sensitive kernel memory.

An out-of-bounds read in the fbdev/fbcon font handling path can occur after fbcon_do_set_font fails during rollback. The error path restores the old font size and character count but can leave vc_hi_font_mask and the screen buffer in a mismatched state. A local user or process that can reach the virtual console font setting path may then cause inflated character indexes to be accepted and later rendered against a reverted 256 character font array. For the CVSS the PR:L is used because reliable triggering requires local access to the console font ioctl path and control over the local execution context, but full administrator privileges are not assumed for the conservative review model. The issue is not network reachable. Impact is primarily kernel memory disclosure through an out-of-bounds read, with no direct evidence of integrity impact or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.