PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46191 Linux CVE debrief

A vulnerability in the Linux kernel's framebuffer console (fbcon) subsystem could allow out-of-bounds (OOB) memory access when console rotation fails. The issue occurs in fbcon_rotate_font(), which previously retained an old, undersized font buffer when reallocation for rotated console output failed. Subsequent character output with sufficiently high character codes could then overflow this buffer. The fix clears the font buffer on reallocation failure, causing putcs implementations to return early rather than accessing invalid memory. This vulnerability affects local console access scenarios where framebuffer console rotation is configured.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

Linux system administrators managing servers or workstations with framebuffer console configurations; embedded systems using fbcon for display output; security teams tracking kernel local privilege escalation vectors

Technical summary

The fbcon_rotate_font() function in the Linux kernel's framebuffer console driver failed to properly handle memory reallocation failures during console rotation. When rotation was requested but buffer reallocation failed, the function retained the original font buffer which was sized for unrotated output. Subsequent character output operations (putcs) with high character codes would then write beyond the allocated buffer bounds. The resolution clears the font buffer pointer on reallocation failure, causing dependent output functions to detect the null buffer and return early without performing memory access.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the fbcon fix for affected stable branches once available through distribution channels
  • Review systems using framebuffer console rotation (fbcon) for local console configurations
  • Monitor kernel stable tree commits for backport status to currently deployed kernel versions
  • Consider disabling framebuffer console rotation where not required as a temporary risk reduction measure

Evidence notes

The vulnerability description and resolution are sourced from the official CVE record published 2026-05-28. The fix involves clearing the font buffer in fbcon_rotate_font() when reallocation fails, preventing subsequent OOB access during character output. Multiple stable kernel branch commits are referenced, indicating backports to maintained kernel versions.

Official resources

2026-05-28