CVE-2026-46191

fbcon: Avoid OOB font access if console rotation fails

State: Published
Severity: Not scored
Published: May 28, 2026
Updated: Oct 15, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

fbcon: Avoid OOB font access if console rotation fails

Clear the font buffer if the reallocation during console rotation fails in fbcon_rotate_font(). The putcs implementations for the rotated buffer will return early in this case. See [1] for an example.

Currently, fbcon_rotate_font() keeps the old buffer, which is too small for the rotated font. Printing to the rotated console with a high-enough character code will overflow the font buffer.

v2: - fix typos in commit message

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	6cc50e1c5b57180fd37a31282000f43859b0fe73 to before b51c343a81e6e806525a4435e22532c107dd7e9dAffected 6cc50e1c5b57180fd37a31282000f43859b0fe73 to before 46cf3646dea54baeaa2eafe3fb1ba769947f31b0Affected 6cc50e1c5b57180fd37a31282000f43859b0fe73 to before 524a6079395916fb3d790ef2bb46a1d2939b27ddAffected 6cc50e1c5b57180fd37a31282000f43859b0fe73 to before 594973a2e54924d8ba31c9faac669fc1ba6fcb80Affected 6cc50e1c5b57180fd37a31282000f43859b0fe73 to before ab6c34b9829d5de03f1d08a47a2253729a6e7e27Affected 6cc50e1c5b57180fd37a31282000f43859b0fe73 to before 7105d9f1387d63b15c9a860674fc92c959181f2fAffected 6cc50e1c5b57180fd37a31282000f43859b0fe73 to before b44cc78ff46b96e72d333a3be6aaaa0a14797263Affected 6cc50e1c5b57180fd37a31282000f43859b0fe73 to before e4ef723d8975a2694cc90733a6b888a5e2841842Affected
LinuxLinux	2.6.15Affected before 2.6.15Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.140 through 6.6.Not affected 6.12.90 through 6.12.Not affected 6.18.32 through 6.18.Not affected 7.0.7 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

6cc50e1c5b57180fd37a31282000f43859b0fe73 to before b51c343a81e6e806525a4435e22532c107dd7e9dAffected
6cc50e1c5b57180fd37a31282000f43859b0fe73 to before 46cf3646dea54baeaa2eafe3fb1ba769947f31b0Affected
6cc50e1c5b57180fd37a31282000f43859b0fe73 to before 524a6079395916fb3d790ef2bb46a1d2939b27ddAffected
6cc50e1c5b57180fd37a31282000f43859b0fe73 to before 594973a2e54924d8ba31c9faac669fc1ba6fcb80Affected
6cc50e1c5b57180fd37a31282000f43859b0fe73 to before ab6c34b9829d5de03f1d08a47a2253729a6e7e27Affected
6cc50e1c5b57180fd37a31282000f43859b0fe73 to before 7105d9f1387d63b15c9a860674fc92c959181f2fAffected
6cc50e1c5b57180fd37a31282000f43859b0fe73 to before b44cc78ff46b96e72d333a3be6aaaa0a14797263Affected
6cc50e1c5b57180fd37a31282000f43859b0fe73 to before e4ef723d8975a2694cc90733a6b888a5e2841842Affected

LinuxLinux

2.6.15Affected
before 2.6.15Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.140 through 6.6.*Not affected
6.12.90 through 6.12.*Not affected
6.18.32 through 6.18.*Not affected
7.0.7 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.