In the Linux kernel, the following vulnerability has been resolved:
fbcon: fix integer overflow in fbcon_do_set_font
Fix integer overflow vulnerabilities in fbcon_do_set_font() where font
size calculations could overflow when handling user-controlled font
parameters.
The vulnerabilities occur when:
1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount
multiplication with user-controlled values that can overflow.
2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow
3. This results in smaller allocations than expected, leading to buffer
overflows during font data copying.
Add explicit overflow checking using check_mul_overflow() and
check_add_overflow() kernel helpers to safety validate all size
calculations before allocation.
fbcon: fix integer overflow in fbcon_do_set_font
Fix integer overflow vulnerabilities in fbcon_do_set_font() where font
size calculations could overflow when handling user-controlled font
parameters.
The vulnerabilities occur when:
1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount
multiplication with user-controlled values that can overflow.
2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow
3. This results in smaller allocations than expected, leading to buffer
overflows during font data copying.
Add explicit overflow checking using check_mul_overflow() and
check_add_overflow() kernel helpers to safety validate all size
calculations before allocation.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
|
||||||||||||||||||||||||||||||||||||||||||
| Linux | Linux | affected |
|
Configuration 1 [-]
|
No data.
| Vendor | Product | Confidence | Versions |
|---|---|---|---|
| Linux | Linux Kernel | — | — |
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-4379-1 | linux-6.1 security update |
| Debian DLA |
DLA-4404-1 | linux security update |
 Debian DSA |
DSA-6053-1 | linux security update |
 Ubuntu USN |
USN-8033-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8033-2 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8033-3 | Linux kernel (FIPS) vulnerabilities |
| Ubuntu USN |
USN-8034-1 | Linux kernel (NVIDIA Tegra) vulnerabilities |
| Ubuntu USN |
USN-8033-4 | Linux kernel (AWS) vulnerabilities |
| Ubuntu USN |
USN-8033-5 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8034-2 | Linux kernel (NVIDIA Tegra IGX) vulnerabilities |
| Ubuntu USN |
USN-8033-6 | Linux kernel (NVIDIA) vulnerabilities |
| Ubuntu USN |
USN-8033-7 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8033-8 | Linux kernel (Intel IoTG) vulnerabilities |
| Ubuntu USN |
USN-8095-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8095-2 | Linux kernel (FIPS) vulnerabilities |
| Ubuntu USN |
USN-8100-1 | Linux kernel (NVIDIA) vulnerabilities |
| Ubuntu USN |
USN-8095-3 | Linux kernel (Real-time) vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 26 Feb 2026 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
cvssV3_1
|
Tue, 03 Feb 2026 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-190 | |
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.9:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.9:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.9:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.9:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.9:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.9:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.9:rc8:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc7:*:*:*:*:*:* |
Mon, 20 Oct 2025 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Vendors & Products |
Linux
Linux linux Kernel |
Fri, 17 Oct 2025 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Wed, 15 Oct 2025 08:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font parameters. The vulnerabilities occur when: 1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount multiplication with user-controlled values that can overflow. 2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow 3. This results in smaller allocations than expected, leading to buffer overflows during font data copying. Add explicit overflow checking using check_mul_overflow() and check_add_overflow() kernel helpers to safety validate all size calculations before allocation. | |
| Title | fbcon: fix integer overflow in fbcon_do_set_font | |
| References |
|
|
MITRE
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2025-10-15T07:55:51.554Z
Reserved: 2025-04-16T07:20:57.149Z
Link: CVE-2025-39967
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2025-10-15T08:15:34.210
Modified: 2026-02-26T23:06:19.070
Link: CVE-2025-39967
Redhat
OpenCVE Enrichment
Updated: 2025-10-20T13:26:59Z
Weaknesses