CVE-2026-31742

Status: UPDATED  |  Advisory ID: CVE-2026-31742

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

vt: discard stale unicode buffer on alt screen exit after resize

When enter_alt_screen() saves vc_uni_lines into vc_saved_uni_lines and

sets vc_uni_lines to NULL, a subsequent console resize via vc_do_resize()

skips reallocating the unicode buffer because vc_uni_lines is NULL.

However, vc_saved_uni_lines still points to the old buffer allocated for

the original dimensions.

When leave_alt_screen() later restores vc_saved_uni_lines, the buffer

dimensions no longer match vc_rows/vc_cols. Any operation that iterates

over the unicode buffer using the current dimensions (e.g. csi_J clearing

the screen) will access memory out of bounds, causing a kernel oops:

BUG: unable to handle page fault for address: 0x0000002000000020

RIP: 0010:csi_J+0x133/0x2d0

The faulting address 0x0000002000000020 is two adjacent u32 space

characters (0x20) interpreted as a pointer, read from the row data area

past the end of the 25-entry pointer array in a buffer allocated for

80x25 but accessed with 240x67 dimensions.

Fix this by checking whether the console dimensions changed while in the

alternate screen. If they did, free the stale saved buffer instead of

restoring it. The unicode screen will be lazily rebuilt via

vc_uniscr_check() when next needed. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References