CVE-2026-31742: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31742 is a memory corruption vulnerability in the Linux kernel's virtual terminal (vt) subsystem, caused by a stale unicode buffer being restored after a console resize while in alternate screen mode. When leave_alt_screen() restores vc_saved_uni_lines after a resize, the buffer dimensions no longer match the current vc_rows/vc_cols, leading to out-of-bounds memory access and a kernel oops. Affected kernel versions include 6.18.20–6.18.21, 6.19.10–6.19.11, and 7.0-rc5/rc6. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an incorrect calculation of buffer size (CWE-131) combined with an out-of-bounds read (CWE-125) in the kernel's vt subsystem. When enter_alt_screen() saves vc_uni_lines into vc_saved_uni_lines and sets vc_uni_lines to NULL, a subsequent vc_do_resize() call skips reallocating the unicode buffer because vc_uni_lines is NULL — leaving vc_saved_uni_lines pointing to a buffer sized for the original console dimensions. Upon leave_alt_screen(), the stale buffer is restored; any operation iterating over it using the new dimensions (e.g., csi_J screen clear) reads past the end of the pointer array, causing a page fault at an address like 0x0000002000000020 (two adjacent u32 space characters misinterpreted as a pointer). Exploitation requires local access and the ability to manipulate console/terminal settings (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation causes a kernel panic (oops), resulting in a denial of service by crashing the affected system. A local user with access to a virtual terminal can trigger the crash by entering alternate screen mode, resizing the console, and then exiting alternate screen mode. There is no evidence of confidentiality or integrity impact beyond the system crash, and lateral movement potential is limited given the local-only attack vector (Red Hat Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term (Red Hat Advisory).

1. Gain local access: Obtain a local user account on a system running a vulnerable Linux kernel version (6.18.20–6.18.21, 6.19.10–6.19.11, or 7.0-rc5/rc6) with access to a virtual terminal (e.g., /dev/tty).
2. Enter alternate screen mode: Use a terminal application or escape sequence (e.g., tput smcup or \033[?1049h) to switch the virtual console into alternate screen mode, causing enter_alt_screen() to save vc_uni_lines into vc_saved_uni_lines and set vc_uni_lines to NULL.
3. Resize the console: While in alternate screen mode, trigger a console resize (e.g., via ioctl(TIOCSWINSZ) or by resizing the terminal window), causing vc_do_resize() to update vc_rows/vc_cols without reallocating the unicode buffer.
4. Exit alternate screen mode: Use the escape sequence to leave alternate screen mode (e.g., tput rmcup or \033[?1049l), causing leave_alt_screen() to restore the stale vc_saved_uni_lines buffer with mismatched dimensions.
5. Trigger out-of-bounds access: Perform any operation that iterates over the unicode buffer using the new dimensions (e.g., clearing the screen with clear or printf '\033[2J'), triggering csi_J to access memory out of bounds and causing a kernel oops/panic (Red Hat Bugzilla).

• Logs: Kernel log entries (dmesg or /var/log/kern.log) showing BUG: unable to handle page fault for address: 0x0000002000000020 and RIP: 0010:csi_J+0x133/0x2d0, indicating an out-of-bounds access in the vt subsystem.
• System: Unexpected system crash or reboot following virtual terminal resize operations; kernel oops traces referencing csi_J, leave_alt_screen, or vc_uniscr_check in the call stack.
• Process: Unusual use of ioctl(TIOCSWINSZ) by non-privileged processes on virtual console devices (/dev/tty*) immediately preceding a system crash (Red Hat Bugzilla).

Patches are available in Linux kernel versions 6.18.22, 6.19.12, and the 7.0 stable release series, via commits to the stable kernel tree (Red Hat Bugzilla). The fix checks whether console dimensions changed while in alternate screen mode and, if so, frees the stale saved buffer rather than restoring it. As a temporary workaround, restrict local console and terminal access to trusted users only. Amazon Linux 2023 users should apply the update referenced in ALAS2023-2026-1746.

Red Hat tracked the issue via Bugzilla (Bug 2464454) and assigned it a medium severity rating. The upstream kernel CVE announcement was published via the linux-cve-announce mailing list. No significant broader media coverage or notable researcher commentary has been identified beyond standard vulnerability tracking.