CVE-2026-31742

{"id": "CVE-2026-31742", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31742", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:12:57.933644Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c4efef65a46f610418a3f69149c51492d31c8591", "lessThan": "891d790fdb5c96c6e1d2841e06ee6c360f2d1288", "versionType": "git"}, {"status": "affected", "version": "1cf66bd9127447c57295f5199029e8d8b47c6c67", "lessThan": "428fdf55301e6c8fa5a36b426240797b1cf86570", "versionType": "git"}, {"status": "affected", "version": "5eb608319bb56464674a71b4a66ea65c6c435d64", "lessThan": "40014493cece72a0be5672cd86763e53fb3ec613", "versionType": "git"}], "programFiles": ["drivers/tty/vt/vt.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.18.20", "lessThan": "6.18.22", "versionType": "semver"}, {"status": "affected", "version": "6.19.10", "lessThan": "6.19.12", "versionType": "semver"}], "programFiles": ["drivers/tty/vt/vt.c"], "defaultStatus": "unaffected"}]}], "published": "2026-05-01T15:16:36.937", "references": [{"url": "https://git.kernel.org/stable/c/40014493cece72a0be5672cd86763e53fb3ec613", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/428fdf55301e6c8fa5a36b426240797b1cf86570", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/891d790fdb5c96c6e1d2841e06ee6c360f2d1288", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: discard stale unicode buffer on alt screen exit after resize\n\nWhen enter_alt_screen() saves vc_uni_lines into vc_saved_uni_lines and\nsets vc_uni_lines to NULL, a subsequent console resize via vc_do_resize()\nskips reallocating the unicode buffer because vc_uni_lines is NULL.\nHowever, vc_saved_uni_lines still points to the old buffer allocated for\nthe original dimensions.\n\nWhen leave_alt_screen() later restores vc_saved_uni_lines, the buffer\ndimensions no longer match vc_rows/vc_cols. Any operation that iterates\nover the unicode buffer using the current dimensions (e.g. csi_J clearing\nthe screen) will access memory out of bounds, causing a kernel oops:\n\n BUG: unable to handle page fault for address: 0x0000002000000020\n RIP: 0010:csi_J+0x133/0x2d0\n\nThe faulting address 0x0000002000000020 is two adjacent u32 space\ncharacters (0x20) interpreted as a pointer, read from the row data area\npast the end of the 25-entry pointer array in a buffer allocated for\n80x25 but accessed with 240x67 dimensions.\n\nFix this by checking whether the console dimensions changed while in the\nalternate screen. If they did, free the stale saved buffer instead of\nrestoring it. The unicode screen will be lazily rebuilt via\nvc_uniscr_check() when next needed."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvt: descartar b\u00fafer Unicode obsoleto al salir de la pantalla alternativa despu\u00e9s de un redimensionamiento\n\nCuando enter_alt_screen() guarda vc_uni_lines en vc_saved_uni_lines y establece vc_uni_lines en NULL, un redimensionamiento posterior de la consola a trav\u00e9s de vc_do_resize() omite la reasignaci\u00f3n del b\u00fafer Unicode porque vc_uni_lines es NULL. Sin embargo, vc_saved_uni_lines todav\u00eda apunta al b\u00fafer antiguo asignado para las dimensiones originales.\n\nCuando leave_alt_screen() m\u00e1s tarde restaura vc_saved_uni_lines, las dimensiones del b\u00fafer ya no coinciden con vc_rows/vc_cols. Cualquier operaci\u00f3n que itere sobre el b\u00fafer Unicode utilizando las dimensiones actuales (por ejemplo, csi_J borrando la pantalla) acceder\u00e1 a memoria fuera de los l\u00edmites, causando un kernel oops:\n\n BUG: no se puede manejar el fallo de p\u00e1gina para la direcci\u00f3n: 0x 0000002000000020\n RIP: 0010:csi_J+0x133/0x2d0\n\nLa direcci\u00f3n de fallo 0x 0000002000000020 son dos caracteres de espacio u32 adyacentes (0x20) interpretados como un puntero, le\u00eddos del \u00e1rea de datos de fila m\u00e1s all\u00e1 del final del array de punteros de 25 entradas en un b\u00fafer asignado para 80x25 pero accedido con dimensiones de 240x67.\n\nSolucione esto comprobando si las dimensiones de la consola cambiaron mientras estaba en la pantalla alternativa. Si lo hicieron, libere el b\u00fafer guardado obsoleto en lugar de restaurarlo. La pantalla Unicode se reconstruir\u00e1 de forma perezosa a trav\u00e9s de vc_uniscr_check() cuando sea necesario de nuevo."}], "lastModified": "2026-11-11T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B6CD870-DF92-432B-A966-F190AE04E97F", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.18.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BF1D424-BCB7-4168-AFD4-DE335B44DACF", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}