diff --git a/build/build.go b/build/build.go
index 39174c9028c..1d06824ac83 100644
--- a/build/build.go
+++ b/build/build.go
@@ -53,7 +53,7 @@ var (
 
 const (
 	printFallbackImage     = "docker/dockerfile:1.5@sha256:dbbd5e059e8a07ff7ea6233b213b36aa516b4c53c645f1817a4dd18b83cbea56"
-	printLintFallbackImage = "docker.io/docker/dockerfile-upstream:1.8.0@sha256:d6d396f3780b1dd56a3acbc975f57bd2fc501989b50164c41387c42d04e780d0"
+	printLintFallbackImage = "docker.io/docker/dockerfile-upstream:1.8.1@sha256:e87caa74dcb7d46cd820352bfea12591f3dba3ddc4285e19c7dcd13359f7cefd"
 )
 
 type Options struct {
diff --git a/commands/build.go b/commands/build.go
index 9cf344040f9..9f85fa2f835 100644
--- a/commands/build.go
+++ b/commands/build.go
@@ -866,7 +866,34 @@ func printResult(f *controllerapi.PrintFunc, res map[string]string) error {
 	case "subrequests.describe":
 		return printValue(subrequests.PrintDescribe, subrequests.SubrequestsDescribeDefinition.Version, f.Format, res)
 	case "lint":
-		return printValue(lint.PrintLintViolations, lint.SubrequestLintDefinition.Version, f.Format, res)
+		err := printValue(lint.PrintLintViolations, lint.SubrequestLintDefinition.Version, f.Format, res)
+		if err != nil {
+			return err
+		}
+
+		lintResults := lint.LintResults{}
+		if result, ok := res["result.json"]; ok {
+			if err := json.Unmarshal([]byte(result), &lintResults); err != nil {
+				return err
+			}
+		}
+		if lintResults.Error != nil {
+			// Print the error message and the source
+			// Normally, we would use `errdefs.WithSource` to attach the source to the
+			// error and let the error be printed by the handling that's already in place,
+			// but here we want to print the error in a way that's consistent with how
+			// the lint warnings are printed via the `lint.PrintLintViolations` function,
+			// which differs from the default error printing.
+			fmt.Println()
+			lintBuf := bytes.NewBuffer([]byte(lintResults.Error.Message + "\n"))
+			sourceInfo := lintResults.Sources[lintResults.Error.Location.SourceIndex]
+			source := errdefs.Source{
+				Info:   sourceInfo,
+				Ranges: lintResults.Error.Location.Ranges,
+			}
+			source.Print(lintBuf)
+			return errors.New(lintBuf.String())
+		}
 	default:
 		if dt, ok := res["result.json"]; ok && f.Format == "json" {
 			fmt.Println(dt)
diff --git a/go.mod b/go.mod
index 057fcafbcbd..806c98572b5 100644
--- a/go.mod
+++ b/go.mod
@@ -27,7 +27,7 @@ require (
 	github.com/hashicorp/go-cty-funcs v0.0.0-20230405223818-a090f58aa992
 	github.com/hashicorp/hcl/v2 v2.20.1
 	github.com/in-toto/in-toto-golang v0.5.0
-	github.com/moby/buildkit v0.14.0
+	github.com/moby/buildkit v0.14.1
 	github.com/moby/sys/mountinfo v0.7.1
 	github.com/moby/sys/signal v0.7.0
 	github.com/morikuni/aec v1.0.0
diff --git a/go.sum b/go.sum
index 62a07bb33f5..01014d37ec4 100644
--- a/go.sum
+++ b/go.sum
@@ -302,8 +302,8 @@ github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyua
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/moby/buildkit v0.14.0 h1:mHv2lFS8znLDRc4SMyM2B9tPjxWh2blMvr0H7ARquNM=
-github.com/moby/buildkit v0.14.0/go.mod h1:1XssG7cAqv5Bz1xcGMxJL123iCv5TYN4Z/qf647gfuk=
+github.com/moby/buildkit v0.14.1 h1:2epLCZTkn4CikdImtsLtIa++7DzCimrrZCT1sway+oI=
+github.com/moby/buildkit v0.14.1/go.mod h1:1XssG7cAqv5Bz1xcGMxJL123iCv5TYN4Z/qf647gfuk=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
diff --git a/tests/build.go b/tests/build.go
index efe2387457c..bc5ba59f197 100644
--- a/tests/build.go
+++ b/tests/build.go
@@ -821,7 +821,7 @@ COPy --from=base \
 		stderr := bytes.Buffer{}
 		cmd.Stdout = &stdout
 		cmd.Stderr = &stderr
-		require.NoError(t, cmd.Run(), stdout.String(), stderr.String())
+		require.Error(t, cmd.Run(), stdout.String(), stderr.String())
 
 		var res lint.LintResults
 		require.NoError(t, json.Unmarshal(stdout.Bytes(), &res))
diff --git a/vendor/github.com/moby/buildkit/frontend/dockerfile/shell/lex.go b/vendor/github.com/moby/buildkit/frontend/dockerfile/shell/lex.go
index 306eb5e8193..86df5b6c433 100644
--- a/vendor/github.com/moby/buildkit/frontend/dockerfile/shell/lex.go
+++ b/vendor/github.com/moby/buildkit/frontend/dockerfile/shell/lex.go
@@ -429,7 +429,8 @@ func (sw *shellWord) processDollar() (string, error) {
 		case '%', '#':
 			// %/# matches the shortest pattern expansion, %%/## the longest
 			greedy := false
-			if word[0] == byte(ch) {
+
+			if len(word) > 0 && word[0] == byte(ch) {
 				greedy = true
 				word = word[1:]
 			}
diff --git a/vendor/github.com/moby/buildkit/frontend/subrequests/lint/lint.go b/vendor/github.com/moby/buildkit/frontend/subrequests/lint/lint.go
index 402a704b955..d207fba3c08 100644
--- a/vendor/github.com/moby/buildkit/frontend/subrequests/lint/lint.go
+++ b/vendor/github.com/moby/buildkit/frontend/subrequests/lint/lint.go
@@ -108,7 +108,7 @@ func (results *LintResults) ToResult() (*client.Result, error) {
 	res.AddMeta("result.txt", b.Bytes())
 
 	status := 0
-	if len(results.Warnings) > 0 {
+	if len(results.Warnings) > 0 || results.Error != nil {
 		status = 1
 	}
 	res.AddMeta("result.statuscode", []byte(fmt.Sprintf("%d", status)))
@@ -169,11 +169,11 @@ func PrintLintViolations(dt []byte, w io.Writer) error {
 	})
 
 	for _, warning := range results.Warnings {
-		fmt.Fprintf(w, "%s", warning.RuleName)
+		fmt.Fprintf(w, "\nWARNING: %s", warning.RuleName)
 		if warning.URL != "" {
 			fmt.Fprintf(w, " - %s", warning.URL)
 		}
-		fmt.Fprintf(w, "\n%s\n", warning.Description)
+		fmt.Fprintf(w, "\n%s\n", warning.Detail)
 
 		if warning.Location.SourceIndex < 0 {
 			continue
@@ -187,8 +187,8 @@ func PrintLintViolations(dt []byte, w io.Writer) error {
 		if err != nil {
 			return err
 		}
-		fmt.Fprintln(w)
 	}
+
 	return nil
 }
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 8e2d41bae4d..27d283fa2b9 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -519,7 +519,7 @@ github.com/mitchellh/go-wordwrap
 # github.com/mitchellh/reflectwalk v1.0.2
 ## explicit
 github.com/mitchellh/reflectwalk
-# github.com/moby/buildkit v0.14.0
+# github.com/moby/buildkit v0.14.1
 ## explicit; go 1.21
 github.com/moby/buildkit/api/services/control
 github.com/moby/buildkit/api/types