Skip to main content

Linux Kernel CVE-2025-40322

| EUVDEUVD-2025-201623 HIGH
2025-12-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Red Hat Suse
7.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Local low-priv attacker drives fbcon rendering with no user interaction (AV:L/AC:L/PR:L/UI:N); OOB read leaks memory and can crash the kernel (C:H/A:H), no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat
7.1 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.1 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201623
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
CVE Published
Dec 08, 2025 - 01:16 cve.org
HIGH 7.1
CVE Published
Dec 08, 2025 - 01:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fbdev: bitblit: bound-check glyph index in bit_putcs*

bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address.

This fixes a global out-of-bounds read reported by syzbot.

AnalysisAI

Out-of-bounds read in the Linux kernel's framebuffer console (fbdev) bitblit code affects the built-in font rendering path, where bit_putcs_aligned() and bit_putcs_unaligned() masked the character value with 0xff/0x1ff and used it as a glyph index without validating it against the actual font's glyph count. A local low-privileged attacker able to drive framebuffer console output can trigger a global out-of-bounds read past the built-in font array, leaking adjacent kernel memory or crashing the system. Discovered by syzbot; no public exploit identified at time of analysis, and with an EPSS of 0.04% real-world exploitation is unlikely to be widespread.

Technical ContextAI

The affected component is the Linux kernel fbdev (framebuffer device) console subsystem, specifically the software bitblit glyph-drawing helpers in drivers/video/fbdev/core/bitblit.c. When rendering characters, bit_putcs_aligned() and bit_putcs_unaligned() computed a glyph pointer as font_data + (character & 0xff or & 0x1ff) * glyph_size. Because the mask permits index values up to 255 (or 511) regardless of how many glyphs the loaded built-in font actually contains, the derived pointer can point beyond the end of the static font array - a classic CWE-125 out-of-bounds read (no CWE was assigned in the feed, but the description explicitly states 'global out-of-bounds read'). The fix clamps the glyph index to the real glyph count before computing the address. This is a read of static/global kernel font data, affecting kernels using the fbcon software blitting path.

RemediationAI

Apply the vendor-released kernel patch by upgrading to a fixed stable release for your series: 6.18 mainline, or backports 6.17.8, 6.12.58, 6.6.117, 6.1.159, 5.15.197, 5.10.247, or 5.4.302. Ubuntu users should install the updates in USN-8096-1 and USN-8095-1 (https://ubuntu.com/security/notices/USN-8096-1 and https://ubuntu.com/security/notices/USN-8095-1) and reboot; upstream commits are available at git.kernel.org/stable (e.g. c12003bf91fdff381c55ef54fef3e961a5af2545 and the associated stable hashes). If patching must be deferred, compensating controls target the attack surface: restrict local console/framebuffer access by limiting untrusted local logins and TTY access, and where feasible avoid or disable fbcon software blitting (e.g. use a DRM/KMS setup or blacklist unnecessary framebuffer drivers) - the trade-off is potential loss of a working text console on affected hardware. These controls reduce but do not eliminate exposure, so patching remains the reliable fix.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40322 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy