In the Linux kernel, the following vulnerability has been resolved: fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font parameters. The vulnerabilities occur when: 1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount multiplication with user-controlled values that can overflow. 2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow 3. This results in smaller allocations than expected, leading to buffer overflows during font data copying. Add explicit overflow checking using check_mul_overflow() and check_add_overflow() kernel helpers to safety validate all size calculations before allocation.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe cve-icon cve-icon
https://git.kernel.org/stable/c/4a4bac869560f943edbe3c2b032062f6673b13d3 cve-icon cve-icon
https://git.kernel.org/stable/c/994bdc2d23c79087fbf7dcd9544454e8ebcef877 cve-icon cve-icon
https://git.kernel.org/stable/c/9c8ec14075c5317edd6b242f1be8167aa1e4e333 cve-icon cve-icon
https://git.kernel.org/stable/c/a6eb9f423b3db000aaedf83367b8539f6b72dcfc cve-icon cve-icon
https://git.kernel.org/stable/c/adac90bb1aaf45ca66f9db8ac100be16750ace78 cve-icon cve-icon
https://git.kernel.org/stable/c/b8a6e85328aeb9881531dbe89bcd2637a06c3c95 cve-icon cve-icon
https://git.kernel.org/stable/c/c0c01f9aa08c8e10e10e8c9ebb5be01a4eff6eb7 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025101555-CVE-2025-39967-0fbf@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-39967 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-39967 cve-icon
History

Mon, 20 Oct 2025 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Fri, 17 Oct 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 15 Oct 2025 08:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font parameters. The vulnerabilities occur when: 1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount multiplication with user-controlled values that can overflow. 2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow 3. This results in smaller allocations than expected, leading to buffer overflows during font data copying. Add explicit overflow checking using check_mul_overflow() and check_add_overflow() kernel helpers to safety validate all size calculations before allocation.
Title fbcon: fix integer overflow in fbcon_do_set_font
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-10-15T07:55:51.554Z

Updated: 2025-10-15T07:55:51.554Z

Reserved: 2025-04-16T07:20:57.149Z

Link: CVE-2025-39967

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-10-15T08:15:34.210

Modified: 2025-10-16T15:29:11.563

Link: CVE-2025-39967

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-10-15T00:00:00Z

Links: CVE-2025-39967 - Bugzilla