---
id: CVE-2022-49948
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vt: Clear selection before changing the font

  When changing the console font with ioctl(KDFONTOP) the new font size
  can be bigger than the previous font
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vt: Clear selection before changing the font

  When changing the console font with ioctl(KDFONTOP) the new font size
  can be bigger than the previous font. A previous sel…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-125
vendor: linux
product: linux_kernel
affected:
  - linux_kernel < 4.9.328
  - 'linux_kernel >= 4.10, < 4.14.293'
  - 'linux_kernel >= 4.15, < 4.19.258'
  - 'linux_kernel >= 4.20, < 5.4.213'
  - 'linux_kernel >= 5.5, < 5.10.142'
  - 'linux_kernel >= 5.11, < 5.15.66'
  - 'linux_kernel >= 5.16, < 5.19.8'
  - linux_kernel = 6.0
patched:
  - linux_kernel 5.19.8
published: '2025-06-18'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:17:26.047'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-49948'
references:
  - url: 'https://git.kernel.org/stable/c/1cf1930369c9dc428d827b60260c53271bff3285'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2535431ae967ad17585513649625fea7db28d4db'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/566f9c9f89337792070b5a6062dff448b3e7977f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/989201bb8c00b222235aff04e6200230d29dc7bb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c555cf04684fde39b5b0dd9fd80730030ee10c4a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c904fe03c4bd1f356a58797d39e2a5d0ca15cefc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e9ba4611ddf676194385506222cce7b0844e708e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f74b4a41c5d7c9522469917e3072e55d435efd9e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00274
epssPercentile: 0.19647
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:29:48.514469Z'
ingestedAt: '2026-10-15T21:45:11.286Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vt: Clear selection before changing the font

When changing the console font with ioctl(KDFONTOP) the new font size
can be bigger than the previous font. A previous selection may thus now
be outside of the new screen size and thus trigger out-of-bounds
accesses to graphics memory if the selection is removed in
vc_do_resize().

Prevent such out-of-memory accesses by dropping the selection before the
various con_font_set() console handlers are called.

## Affected

- `linux_kernel < 4.9.328`
- `linux_kernel >= 4.10, < 4.14.293`
- `linux_kernel >= 4.15, < 4.19.258`
- `linux_kernel >= 4.20, < 5.4.213`
- `linux_kernel >= 5.5, < 5.10.142`
- `linux_kernel >= 5.11, < 5.15.66`
- `linux_kernel >= 5.16, < 5.19.8`
- `linux_kernel = 6.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 5.19.8`