Loading vulnerability…
Linux kernel virtual-terminal information disclosure in con_font_get()
CVE-2024-50076 is an information disclosure vulnerability in the Linux kernel virtual-terminal subsystem's con_font_get() function. Depending on the console driver's vc->vc_sw->con_font_get implementation, the allocated font.data buffer may not be completely initialized before being returned to the caller. Uninitialized portions can expose residual kernel memory. The fix zero-initializes the allocated buffer before the driver populates it.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose residual kernel memory through returned font data, potentially exposing sensitive information. Direct integrity compromise, code execution, and denial of service are not established for this vulnerability.
If you can’t patch tonight, do this now.
No CVE-specific temporary workaround or compensating control is documented. Vendor kernel updates are the established corrective measure.
Patch, then assume compromise.
Install a vendor kernel update containing the con_font_get() buffer zero-initialization fix. Fixed builds include RHEL 9.6 kernel 5.14.0-570.129.1.el9_6 under RHSA-2026:44385; applicable openSUSE Leap 15.6 and SUSE Linux Enterprise 15 SP6 kernel packages at 6.4.0-150600.23.30.1 under SUSE-2024-4318; SUSE Linux Enterprise Confidential Computing Module 15 SP6 kernel packages at 6.4.0-15061.9.coco15sp6.1; and applicable SUSE Linux Micro 6.1 kernel packages at 6.4.0-22.1. Select the update appropriate to the installed product and support stream. Reboot into the updated kernel; Red Hat explicitly requires a reboot.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.