Out-of-bounds Read Affecting kernel-uki-virt-addons package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RHEL10-KERNELUKIVIRTADDONS-21685748
- published24 Oct 2026
- disclosed18 Oct 2026
Introduced: 18 Oct 2026
NewCVE-2026-98838 (opens in a new tab)How to fix?
There is no fixed version for RHEL:10 kernel-uki-virt-addons.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-uki-virt-addons package and not the kernel-uki-virt-addons package as distributed by RHEL.
See How to fix? for RHEL:10 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
vt: skip screen update for DEC alignment test on backgroup consoles
[BUG] Recently, we encountered a KASAN warning as follows:
BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0x11f/0x140 Read of size 1 at addr ff1100015fd9f6a4 by task tty_fbcon_oob/1239 CPU: 7 UID: 0 PID: 1239 Comm: tty_fbcon_oob Not tainted 7.3.0-rc1 #100 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 Call Trace: <TASK> ... kasan_report+0xf0/0x120 fb_pad_aligned_buffer+0x11f/0x140 ccw_putcs+0x86c/0xa80 fbcon_putcs+0x338/0x410 do_update_region+0x21d/0x450 do_con_write+0x1e0e/0x4880 con_write+0x13/0x80 n_tty_write+0x374/0x1010 file_tty_write.isra.0+0x404/0x7a0 ...
reproduce:
- open /dev/tty0, set a KDFONTOP ioctl with op.op = KD_FONT_OP_SET, op.width = 8 and op.height = 16 (visible VC1)
- open /dev/tty1, set a KDFONTOP ioctl with op.op = KD_FONT_OP_SET, op.width = 28 and op.height = 24 (invisible VC2)
- echo 3 > /sys/devices/virtual/graphics/fbcon/rotate_all
- write EShash8(esc hash8) to tty1
[CAUSE] All VCs render to the framebuffer. setfont only modifies the target VC's font without resizing the framebuffer backing buffer (par->rotated.buf); the buffer is only resized for the visible VC (fbcon_do_set_font -> ... -> vc_do_resize -> update_screen). This relies on the con_should_update() check performed before every update_region().
However, the ESC # 8 path (do_con_trol -> do_update_region) omits the con_should_update() check. After changing the font size of an invisible VC, do_update_region() fills using the new font size against a buffer that was never resized, causing an out-of-bounds access.
[FIX] Only push the update when the console is visible and not blanked, add the con_should_update() check in the do_con_trol() like every other call site of do_update_region() (update_region(), invert_screen(), ...).
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2555252
- https://access.redhat.com/security/cve/CVE-2026-98838
- https://git.kernel.org/stable/c/0928ed9bd7946baee911efa401088697836e3b1e
- https://git.kernel.org/stable/c/0ee53081425a1a31ce15089012cd96b8353eb44e
- https://git.kernel.org/stable/c/985c000b046ca4ee11ee34ef85db500c569ef6e8
- https://git.kernel.org/stable/c/ad06f7312d3f615dd466483ce81a9b9619166686
- https://git.kernel.org/stable/c/2fc4e71aefab57c80ccc9775aad2af503fc90810