Linux Kernel CVE-2025-40304

The vulnerability lives in the kernel framebuffer console subsystem (fbdev/fbcon), specifically the software drawing helper bit_putcs, which renders character strings into a framebuffer via bit_putcs_aligned and bit_putcs_unaligned. When a string is drawn near the right screen edge, the image width is clipped to fit the visible framebuffer, but the character count (cnt) passed to the aligned/unaligned renderers was not updated to match the clipped width. The renderers therefore allocate a buffer sized for the clipped width while iterating over the original, larger count, writing past the end of a vmalloc'd framebuffer region - a classic buffer overflow (CWE-787-style out-of-bounds write; the CWE field was reported as N/A but the tags confirm 'Buffer Overflow'). Affected products per NVD/EUVD CPE data are the mainline Linux kernel from the initial fbcon lineage (commit 1da177e4, i.e. 2.6.12-era code) up to the fixed points. The bug is reachable through the framebuffer console text path, so it depends on fbcon/fbdev being active and text being drawn at boundary positions.