Out-of-bounds read in Linux kernel - CVE-2026-53402

Vulnerability identifier: #VU138862

CSH Severity: Low

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-53402

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in fbcon_do_set_font() and subsequent rendering in the fbcon console subsystem when handling a failed font change rollback and later rendering user-controlled character indices. A local user can trigger a font change failure and then supply character indices greater than 255 to disclose sensitive information.

Exploitation requires a failure in the font-setting error path that leaves the console state desynchronized after vc_resize() fails.

Linux kernel
Debian Linux
Ubuntu
openEuler
kernel
python3-perf-debuginfo
python3-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools-debuginfo
kernel-tools
kernel-source
kernel-headers
kernel-devel
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
bpftool
linux (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-oracle-5.15 (Ubuntu package)
linux-gcp-5.15 (Ubuntu package)
linux-gcp (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-nvidia-tegra (Ubuntu package)
linux (Debian package)
linux-oracle-7.0 (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-azure (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
linux-nvidia-7.0 (Ubuntu package)
linux-raspi (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel - update to 5.10.0-329.0.0.230
python3-perf-debuginfo - update to 5.10.0-329.0.0.230
python3-perf - update to 5.10.0-329.0.0.230
perf-debuginfo - update to 5.10.0-329.0.0.230
perf - update to 5.10.0-329.0.0.230
kernel-tools-devel - update to 5.10.0-329.0.0.230
kernel-tools-debuginfo - update to 5.10.0-329.0.0.230
kernel-tools - update to 5.10.0-329.0.0.230
kernel-source - update to 5.10.0-329.0.0.230
kernel-headers - update to 5.10.0-329.0.0.230
kernel-devel - update to 5.10.0-329.0.0.230
kernel-debugsource - update to 5.10.0-329.0.0.230
kernel-debuginfo - update to 5.10.0-329.0.0.230
bpftool-debuginfo - update to 5.10.0-329.0.0.230
bpftool - update to 5.10.0-329.0.0.230
linux (Ubuntu package) - addressed in versions 5.15.0-195.205~20.04.1, 5.15.0-195.205, 5.15.0-198.208~20.04.1, 5.15.0-198.208+fips1, 5.15.0-1080.84, 5.15.0-1100.108, 5.15.0-1109.111, 5.15.0-1109.114, 5.15.0-1111.115~20.04.1, 5.15.0-1111.115, 5.15.0-1112.118~20.04.1, 5.15.0-1112.118, 5.15.0-1113.119, 5.15.0-1114.120, 5.15.0-1116.125~20.04.1, 5.15.0-1117.124~20.04.1, 5.15.0-1117.124, 5.15.0-1117.124+fips1, 5.15.0-1122.131~20.04.1, 5.15.0-1123.132~20.04.1, 5.15.0-1123.132, 5.15.0-1123.132+fips1, 5.15.0.195.160, 5.15.0.195.205~20.04.1, 5.15.0.198.114, 5.15.0.198.171, 5.15.0.198.208~20.04.1, 5.15.0.1080.83~20.04.1, 5.15.0.1100.99, 5.15.0.1109.105, 5.15.0.1109.113, 5.15.0.1111.108, 5.15.0.1111.115~20.04.1, 5.15.0.1112.111, 5.15.0.1112.118~20.04.1, 5.15.0.1113.112, 5.15.0.1114.110, 5.15.0.1116.120, 5.15.0.1117.113, 5.15.0.1117.120, 5.15.0.1117.124~20.04.1, 5.15.0.1122.131~20.04.1, 5.15.0.1123.107, 5.15.0.1123.121, 5.15.0.1123.132~20.04.1, 7.0.0-31.31~24.04.1, 7.0.0-31.31, 7.0.0-31.31.1, 7.0.0-1006.7, 7.0.0-1011.11~24.04.1, 7.0.0-1012.12~24.04.1, 7.0.0-1012.12
linux-nvidia (Ubuntu package) - addressed in versions 5.15.0-1112.113, 5.15.0.1112.112, 7.0.0-1018.18
linux-oracle-5.15 (Ubuntu package) - addressed in versions 5.15.0-1114.120~20.04.1, 5.15.0.1114.120~20.04.1
linux-gcp-5.15 (Ubuntu package) - addressed in versions 5.15.0-1118.128~20.04.1, 5.15.0.1118.128~20.04.1
linux-gcp (Ubuntu package) - addressed in versions 5.15.0-1118.128, 5.15.0-1118.128+fips1, 5.15.0.1118.107, 5.15.0.1118.115
linux-azure-fde (Ubuntu package) - addressed in versions 5.15.0-1122.131, 5.15.0.1122.131
linux-nvidia-tegra (Ubuntu package) - update to 6.8.0-1036.39+1
linux (Debian package) - update to 6.12.96-1
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1011.11, 7.0.0-1014.14
linux-ibm (Ubuntu package) - update to 7.0.0-1013.13
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1013.13
linux-azure-7.0 (Ubuntu package) - update to 7.0.0-1014.14~24.04.1
linux-nvidia-7.0 (Ubuntu package) - update to 7.0.0-1018.18~24.04.1
linux-raspi (Ubuntu package) - update to 7.0.0-1019.19
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2018.18

• https://git.kernel.org/stable/c/076b1aa65f77a49bce5a48a4a55a397cfcafa2b8
• https://git.kernel.org/stable/c/39815715cbcfabb16fc8c5f4a23deeda20f5df62
• https://git.kernel.org/stable/c/8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2
• https://git.kernel.org/stable/c/b5bb2c696e140c399cb874def2feedf61dee27d6

• Out-of-bounds read in Linux kernel fbdev core driver
• Debian update for linux
• openEuler 22.03 LTS SP4 update for kernel
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux
• Ubuntu update for linux-gcp-7.0
• Ubuntu update for linux-oracle-7.0
• Ubuntu update for linux-azure
• Ubuntu update for linux-azure-7.0
• Ubuntu update for linux-nvidia
• Ubuntu update for linux-nvidia-bos
• Ubuntu update for linux-ibm
• Ubuntu update for linux-raspi
• Ubuntu update for linux-nvidia-7.0
• Ubuntu update for linux-nvidia
• Ubuntu update for linux-nvidia-tegra
• Ubuntu update for linux-azure-fde
• Ubuntu update for linux-gcp
• Ubuntu update for linux-gcp-5.15
• Ubuntu update for linux-oracle-5.15
• Ubuntu update for linux