LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26798: fbcon: always restore the old font data in fbcon_do_set_font()

In the Linux kernel, the following vulnerability has been resolved: fbcon: always restore the old font data in fbcon_do_set_font() Commit a5a923038d70 (fbdev: fbcon: Properly revert changes when vc_resize() failed) started restoring old font data upon failure (of vc_resize()). But it performs so only for user fonts. It means that the "system"/internal fonts are not restored at all. So in result, the very first call to fbcon_do_set_font() performs no restore at all upon failing vc_resize(). This can be reproduced by Syzkaller to crash the system on the next invocation of font_get(). It's rather hard to hit the allocation failure in vc_resize() on the first font_set(), but not impossible. Esp. if fault injection is used to aid the execution/failure. It was demonstrated by Sirius: BUG: unable to handle page fault for address: fffffffffffffff8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD cb7b067 P4D cb7b067 PUD cb7d067 PMD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 8007 Comm: poc Not tainted 6.7.0-g9d1694dc91ce #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:fbcon_get_font+0x229/0x800 drivers/video/fbdev/core/fbcon.c:2286 Call Trace: <TASK> con_font_get drivers/tty/vt/vt.c:4558 [inline] con_font_op+0x1fc/0xf20 drivers/tty/vt/vt.c:4673 vt_k_ioctl drivers/tty/vt/vt_ioctl.c:474 [inline] vt_ioctl+0x632/0x2ec0 drivers/tty/vt/vt_ioctl.c:752 tty_ioctl+0x6f8/0x1570 drivers/tty/tty_io.c:2803 vfs_ioctl fs/ioctl.c:51 [inline] ... So restore the font data in any case, not only for user fonts. Note the later 'if' is now protected by 'old_userfont' and not 'old_data' as the latter is always set now. (And it is supposed to be non-NULL. Otherwise we would see the bug above again.)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw can crash a system when console font handling fails to restore old font data after a resize failure. The public record describes a Syzkaller-demonstrated kernel crash, not confirmed real-world exploitation. Business urgency is highest for Linux systems where untrusted users can reach local console or virtual terminal paths.

Executive priority

Treat as a maintenance-priority kernel stability issue, not an internet-scale emergency based on current evidence. Patch through normal kernel update channels, with faster handling for shared Linux hosts or environments where untrusted local users have console access.

Technical view

CVE-2024-26798 affects Linux fbcon font handling in fbcon_do_set_font(). A prior fix restored old font data only for user fonts after vc_resize() failure; internal fonts were not restored. A later font_get path can dereference invalid font data and trigger a kernel page fault. Stable kernel commits restore font data in all cases.

Likely exposure

Exposure appears tied to Linux systems using fbdev/fbcon virtual console font operations. The source evidence points to tty/vt ioctl and fbcon paths, not a remotely reachable network service. Exact exposure depends on kernel version, distro backports, console availability, and whether local users can access the relevant device paths.

Exploitation context

The record cites Syzkaller reproduction and fault injection making allocation failure easier to hit. It says the first failing font_set is hard to trigger but not impossible. KEV is false, and the provided sources do not report active exploitation or a public weaponized exploit.

Researcher notes

The source record provides no CVSS, CWE, or confirmed exploit status. The affected version data is commit-heavy and should be reconciled with vendor advisories before asset decisions. Analysis should focus on fbcon_do_set_font(), vc_resize() failure handling, and whether old font data restoration is backported.

Mitigation direction

  • Apply vendor kernel updates containing the referenced stable fbcon fixes.
  • Map distro package versions to the CVE and kernel stable commits.
  • Prioritize multi-user Linux systems with local console or virtual terminal access.
  • If updates are unavailable, follow vendor guidance for temporary risk reduction.

Validation and detection

  • Inventory Linux kernel versions and distro backport status across affected assets.
  • Check whether fbdev/fbcon and virtual console access are present on target systems.
  • Confirm installed kernels include one of the referenced stable fixes or equivalent backport.
  • Review system logs for unexplained kernel oops or crashes in fbcon/vt paths.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26798 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux868749a7456dc48e93887a8474194e2ee6d6c21f, ebd6f886aa2447fcfcdce5450c9e1028e1d681bb, a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24, a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24, a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24, a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24, f08ccb792d3eaf1dc62d8cbf6a30d6522329f660, 5.15.64, 5.19.6unaffected
LinuxLinux6.0, 0, 5.15.151, 6.1.81, 6.6.21, 6.7.9, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.