PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46191 Linux CVE debrief

A vulnerability in the Linux kernel's framebuffer console (fbcon) subsystem could allow out-of-bounds (OOB) memory access when console rotation fails. The issue occurs in fbcon_rotate_font(), which previously retained an old, undersized font buffer when reallocation for rotated console output failed. Subsequent character output with sufficiently high character codes could then overflow this buffer. The fix clears the font buffer on reallocation failure, causing putcs implementations to return early rather than accessing invalid memory. This vulnerability affects local console access scenarios where framebuffer console rotation is configured.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-19
Advisory published
2026-05-28
Advisory updated
2026-06-19

Who should care

Linux system administrators managing servers or workstations with framebuffer console configurations; embedded systems using fbcon for display output; security teams tracking kernel local privilege escalation vectors

Technical summary

The fbcon_rotate_font() function in the Linux kernel's framebuffer console driver failed to properly handle memory reallocation failures during console rotation. When rotation was requested but buffer reallocation failed, the function retained the original font buffer which was sized for unrotated output. Subsequent character output operations (putcs) with high character codes would then write beyond the allocated buffer bounds. The resolution clears the font buffer pointer on reallocation failure, causing dependent output functions to detect the null buffer and return early without performing memory access.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the fbcon fix for affected stable branches once available through distribution channels
  • Review systems using framebuffer console rotation (fbcon) for local console configurations
  • Monitor kernel stable tree commits for backport status to currently deployed kernel versions
  • Consider disabling framebuffer console rotation where not required as a temporary risk reduction measure

Evidence notes

The vulnerability description and resolution are sourced from the official CVE record published 2026-05-28. The fix involves clearing the font buffer in fbcon_rotate_font() when reallocation fails, preventing subsequent OOB access during character output. Multiple stable kernel branch commits are referenced, indicating backports to maintained kernel versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46191 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46191

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46191 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46191

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/594973a2e54924d8ba31c9faac669fc1ba6fcb80

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7105d9f1387d63b15c9a860674fc92c959181f2f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ab6c34b9829d5de03f1d08a47a2253729a6e7e27

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b44cc78ff46b96e72d333a3be6aaaa0a14797263

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e4ef723d8975a2694cc90733a6b888a5e2841842

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.