The Linux kernel fbcon subsystem had a vulnerability where the error path in fbcon_do_set_font() failed to restore the hi_font mask and screen buffer after a failure in vc_resize(), causing a state machine corruption. Because the hi_font mask remained set, the VT subsystem accepted character indices beyond 255 and wrote them to the screen buffer. Subsequent rendering used these indices to access a reverted 256-character font array, resulting in a deterministic out-of-bounds read and potential kernel memory disclosure. The fix adds the missing rollback logic to the error path to prevent this desynchronization.

This vulnerability can lead to a deterministic out-of-bounds read in kernel memory, potentially disclosing sensitive kernel memory contents. It affects the framebuffer console subsystem, which could be exploited by local userspace processes interacting with the VT subsystem. There is no indication of remote exploitation or privilege escalation in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves adding rollback logic for the hi_font mask and screen buffer in the error path of fbcon_do_set_font(). Until an official patch is confirmed, avoid triggering font changes under heavy memory pressure or restrict untrusted userspace access to the VT subsystem.