CVE-2025-39967

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-39967
In the Linux kernel, the following vulnerability has been resolved: fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font parameters. The vulnerabilities occur when: 1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount multiplication with user-controlled values that can overflow. 2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow 3. This results in smaller allocations than expected, leading to buffer overflows during font data copying. Add explicit overflow checking using check_mul_overflow() and check_add_overflow() kernel helpers to safety validate all size calculations before allocation.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe Patch
https://git.kernel.org/stable/c/4a4bac869560f943edbe3c2b032062f6673b13d3 Patch
https://git.kernel.org/stable/c/994bdc2d23c79087fbf7dcd9544454e8ebcef877 Patch
https://git.kernel.org/stable/c/9c8ec14075c5317edd6b242f1be8167aa1e4e333 Patch
https://git.kernel.org/stable/c/a6eb9f423b3db000aaedf83367b8539f6b72dcfc Patch
https://git.kernel.org/stable/c/adac90bb1aaf45ca66f9db8ac100be16750ace78 Patch
https://git.kernel.org/stable/c/b8a6e85328aeb9881531dbe89bcd2637a06c3c95 Patch
https://git.kernel.org/stable/c/c0c01f9aa08c8e10e10e8c9ebb5be01a4eff6eb7 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc8:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc7:*:*:*:*:*:*
History

26 Feb 2026, 23:06

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.5 		v2 : unknown
v3 : 7.8

03 Feb 2026, 14:12

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:5.9:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc8:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc5:*:*:*:*:*:*
CWE CWE-190
References () https://git.kernel.org/stable/c/1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe - () https://git.kernel.org/stable/c/1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe - Patch
References () https://git.kernel.org/stable/c/4a4bac869560f943edbe3c2b032062f6673b13d3 - () https://git.kernel.org/stable/c/4a4bac869560f943edbe3c2b032062f6673b13d3 - Patch
References () https://git.kernel.org/stable/c/994bdc2d23c79087fbf7dcd9544454e8ebcef877 - () https://git.kernel.org/stable/c/994bdc2d23c79087fbf7dcd9544454e8ebcef877 - Patch
References () https://git.kernel.org/stable/c/9c8ec14075c5317edd6b242f1be8167aa1e4e333 - () https://git.kernel.org/stable/c/9c8ec14075c5317edd6b242f1be8167aa1e4e333 - Patch
References () https://git.kernel.org/stable/c/a6eb9f423b3db000aaedf83367b8539f6b72dcfc - () https://git.kernel.org/stable/c/a6eb9f423b3db000aaedf83367b8539f6b72dcfc - Patch
References () https://git.kernel.org/stable/c/adac90bb1aaf45ca66f9db8ac100be16750ace78 - () https://git.kernel.org/stable/c/adac90bb1aaf45ca66f9db8ac100be16750ace78 - Patch
References () https://git.kernel.org/stable/c/b8a6e85328aeb9881531dbe89bcd2637a06c3c95 - () https://git.kernel.org/stable/c/b8a6e85328aeb9881531dbe89bcd2637a06c3c95 - Patch
References () https://git.kernel.org/stable/c/c0c01f9aa08c8e10e10e8c9ebb5be01a4eff6eb7 - () https://git.kernel.org/stable/c/c0c01f9aa08c8e10e10e8c9ebb5be01a4eff6eb7 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel

15 Oct 2025, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-10-15 08:15

Updated : 2026-02-26 23:06

NVD link : CVE-2025-39967

Mitre link : CVE-2025-39967

CVE.ORG link : CVE-2025-39967

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-190

Integer Overflow or Wraparound