CVE-2026-46191

HighCVSS 7.1/10Last modified Nov 6, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

fbcon: Avoid OOB font access if console rotation fails

Clear the font buffer if the reallocation during console rotation fails in fbcon_rotate_font(). The putcs implementations for the rotated buffer will return early in this case. See [1] for an example.

Currently, fbcon_rotate_font() keeps the old buffer, which is too small for the rotated font. Printing to the rotated console with a high-enough character code will overflow the font buffer.

v2: - fix typos in commit message

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
LinuxLinux>= 6cc50e1c5b57180fd37a31282000f43859b0fe73, < b51c343a81e6e806525a4435e22532c107dd7e9d; >= 6cc50e1c5b57180fd37a31282000f43859b0fe73, < 46cf3646dea54baeaa2eafe3fb1ba769947f31b0; >= 6cc50e1c5b57180fd37a31282000f43859b0fe73, < 524a6079395916fb3d790ef2bb46a1d2939b27dd; >= 6cc50e1c5b57180fd37a31282000f43859b0fe73, < 594973a2e54924d8ba31c9faac669fc1ba6fcb80; >= 6cc50e1c5b57180fd37a31282000f43859b0fe73, < ab6c34b9829d5de03f1d08a47a2253729a6e7e27; >= 6cc50e1c5b57180fd37a31282000f43859b0fe73, < 7105d9f1387d63b15c9a860674fc92c959181f2f; >= 6cc50e1c5b57180fd37a31282000f43859b0fe73, < b44cc78ff46b96e72d333a3be6aaaa0a14797263; >= 6cc50e1c5b57180fd37a31282000f43859b0fe73, < e4ef723d8975a2694cc90733a6b888a5e2841842
LinuxLinux2.6.15
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< *

References

Timeline

Published
May 28, 2026
Last modified
Nov 6, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-461925.5In the Linux kernel, the following vulnerability has been resolved: spi: microchip-core-qspi: don't attempt to transmit during emulated reaCVE-2026-461935.5In the Linux kernel, the following vulnerability has been resolved: xfrm: ah: account for ESN high bits in async callbacks AH allocates itCVE-2026-461959.8In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parse_sCVE-2026-461965.5In the Linux kernel, the following vulnerability has been resolved: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_fCVE-2026-461977.8In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: validate SVM ioctl nattr against buffer size Validate nattCVE-2026-461988.8In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix integer overflow on buff_pos Fixing an integer overfloCVE-2026-461997.1In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Check bounds aCVE-2026-46209.8OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.CVE-2026-462005.5In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: fix controller deregistration Make sure to deregister thCVE-2026-462017.8In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() When xe_dCVE-2026-462025.5In the Linux kernel, the following vulnerability has been resolved: HID: appletb-kbd: run inactivity autodim from workqueues The autodim cCVE-2026-462037.1In the Linux kernel, the following vulnerability has been resolved: spi: cadence-quadspi: fix unclocked access on unbind Make sure that th
CVE-2026-46191: High severity, CVSS 7.1 | Vulnix