Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2025-39967

fbcon: fix integer overflow in fbcon_do_set_font

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font parameters. The vulnerabilities occur when: 1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount multiplication with user-controlled values that can overflow. 2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow 3. This results in smaller allocations than expected, leading to buffer overflows during font data copying. Add explicit overflow checking using check_mul_overflow() and check_add_overflow() kernel helpers to safety validate all size calculations before allocation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 96e41fc29e8af5c5085fb8a79cab8d0d00bab86c to < 994bdc2d23c79087fbf7dcd9544454e8ebcef877affected
  • 39b3cffb8cf3111738ea993e2757ab382253d86a to < 9c8ec14075c5317edd6b242f1be8167aa1e4e333affected
  • 39b3cffb8cf3111738ea993e2757ab382253d86a to < b8a6e85328aeb9881531dbe89bcd2637a06c3c95affected
  • 39b3cffb8cf3111738ea993e2757ab382253d86a to < a6eb9f423b3db000aaedf83367b8539f6b72dcfcaffected
  • 39b3cffb8cf3111738ea993e2757ab382253d86a to < adac90bb1aaf45ca66f9db8ac100be16750ace78affected
  • 39b3cffb8cf3111738ea993e2757ab382253d86a to < 4a4bac869560f943edbe3c2b032062f6673b13d3affected
  • 39b3cffb8cf3111738ea993e2757ab382253d86a to < c0c01f9aa08c8e10e10e8c9ebb5be01a4eff6eb7affected
  • 39b3cffb8cf3111738ea993e2757ab382253d86a to < 1a194e6c8e1ee745e914b0b7f50fa86c89ed13feaffected
  • ae021a904ac82d9fc81c25329d3c465c5a7d5686affected
  • 451bffa366f2cc0e5314807cb847f31c0226efedaffected
  • 2c455e9c5865861f5ce09c5f596909495ed7657caffected
  • 72f099805dbc907fbe8fa19bccdc31d3e2ee6e9eaffected
  • 34cf1aff169dc6dedad8d79da7bf1b4de2773dbcaffected
  • 5.4.62 to < 5.4.300affected
  • 4.4.235 to < 4.5affected
  • 4.9.235 to < 4.10affected
  • 4.14.196 to < 4.15affected
  • 4.19.143 to < 4.20affected
  • 5.8.6 to < 5.9affected

Linux Linux

Default version status: affected

  • 5.9affected
  • 0 to < 5.9unaffected
  • 5.4.300 to ≤ 5.4.*unaffected
  • 5.10.245 to ≤ 5.10.*unaffected
  • 5.15.194 to ≤ 5.15.*unaffected
  • 6.1.155 to ≤ 6.1.*unaffected
  • 6.6.109 to ≤ 6.6.*unaffected
  • 6.12.50 to ≤ 6.12.*unaffected
  • 6.16.10 to ≤ 6.16.*unaffected
  • 6.17 to ≤ *unaffected

References