In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles [BUG]… (CVE-2026-98838)

The Linux kernel vulnerability (CVE-2026-98838) involves an out-of-bounds read triggered by the vt subsystem when performing screen updates on background (invisible) virtual consoles after changing font sizes. The root cause is that the framebuffer buffer resizing only occurs for visible virtual consoles, but the ESC # 8 control path omitted the con_should_update() visibility check before updating the screen. This leads to do_update_region() filling the framebuffer using a font size that does not match the buffer size, causing slab-out-of-bounds access. The fix adds the missing con_should_update() check in the do_con_trol() function to ensure updates only occur on visible and non-blanked consoles.

The vulnerability causes a slab-out-of-bounds read in the framebuffer code of the Linux kernel, which could lead to kernel memory corruption or instability. There is no evidence of known exploits in the wild. The impact is limited to kernel memory safety and potential system crashes or undefined behavior when the specific sequence of font changes and console updates is performed.

A fix has been implemented in the Linux kernel to add the missing visibility check before screen updates on virtual consoles. Users should update to a kernel version that includes this fix. Since this is a kernel-level bug, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation. No additional mitigations are indicated by the vendor advisory.