Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-39967

fbcon: fix integer overflow in fbcon_do_set_font

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.4.300, 4.5, 4.10, 4.15, 4.20, and 1 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font parameters. The vulnerabilities occur when: 1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount multiplication with user-controlled values that can overflow. 2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow 3. This results in smaller allocations than expected, leading to buffer overflows during font data copying. Add explicit overflow checking using check_mul_overflow() and check_add_overflow() kernel helpers to safety validate all size calculations before allocation.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 5.4.62 · fixed in 5.4.300; From 4.4.235 · fixed in 4.5; From 4.9.235 · fixed in 4.10; From 4.14.196 · fixed in 4.15; From 4.19.143 · fixed in 4.20; From 5.8.6 · fixed in 5.9

  • Linux Linux

    5.9

References 8

git.kernel.org