CVE-2026-46191CWE-125

CVE-2026-46191

High · published May 28, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
2.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

fbcon: Avoid OOB font access if console rotation fails

Clear the font buffer if the reallocation during console rotation fails

in fbcon_rotate_font(). The putcs implementations for the rotated buffer

will return early in this case. See [1] for an example.

Currently, fbcon_rotate_font() keeps the old buffer, which is too small

for the rotated font. Printing to the rotated console with a high-enough

character code will overflow the font buffer.

v2:

- fix typos in commit message

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00137 · 2.8th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-05-28T14:16Z
Affected products (4)
ProductVersionsFixed in
linux/linux_kernel≥ 2.6.15, < 6.6.1406.6.140
linux/linux_kernel≥ 6.7, < 6.12.906.12.90
linux/linux_kernel≥ 6.13, < 6.18.326.18.32
linux/linux_kernel≥ 6.19, < 7.0.77.0.7
References (9)
EPSS history
Timeline
  • 28 MAY 09:36Z
    fbcon: Avoid OOB font access if console rotation fails
    cvelistv5