In the Linux kernel, the following vulnerability has been resolved:
fbcon: fix integer overflow in fbcondoset_font
Fix integer overflow vulnerabilities in fbcondoset_font() where font size calculations could overflow when handling user-controlled font parameters.
The vulnerabilities occur when: 1. CALCFONTSZ(h, pitch, charcount) performs h * pith * charcount multiplication with user-controlled values that can overflow. 2. FONTEXTRA_WORDS * sizeof(int) + size addition can also overflow 3. This results in smaller allocations than expected, leading to buffer overflows during font data copying.
Add explicit overflow checking using checkmuloverflow() and checkaddoverflow() kernel helpers to safety validate all size calculations before allocation.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe",
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"302896299577693567194999087848860257533",
"309336591303083286520722828189795175584",
"187494820890509838907465317410448144934",
"323262172298181026783308476759858074316",
"68954394609626948046111667643773886277"
],
"threshold": 0.9
},
"id": "CVE-2025-39967-00260a7c",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@994bdc2d23c79087fbf7dcd9544454e8ebcef877",
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"302896299577693567194999087848860257533",
"309336591303083286520722828189795175584",
"187494820890509838907465317410448144934",
"323262172298181026783308476759858074316",
"100939190147029979978530440412157313895"
],
"threshold": 0.9
},
"id": "CVE-2025-39967-0834b2fa",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0c01f9aa08c8e10e10e8c9ebb5be01a4eff6eb7",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "245463253433477630997544021027983732524",
"length": 1925.0
},
"id": "CVE-2025-39967-1be23de9",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_font"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0c01f9aa08c8e10e10e8c9ebb5be01a4eff6eb7",
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"302896299577693567194999087848860257533",
"309336591303083286520722828189795175584",
"187494820890509838907465317410448144934",
"323262172298181026783308476759858074316",
"68954394609626948046111667643773886277"
],
"threshold": 0.9
},
"id": "CVE-2025-39967-27cc783b",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6eb9f423b3db000aaedf83367b8539f6b72dcfc",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "163935814053181978266849451118089024779",
"length": 1870.0
},
"id": "CVE-2025-39967-507166c5",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_font"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8a6e85328aeb9881531dbe89bcd2637a06c3c95",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "216549256882400203522968032691398806985",
"length": 1890.0
},
"id": "CVE-2025-39967-5d5120ab",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_font"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@994bdc2d23c79087fbf7dcd9544454e8ebcef877",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "328212964552398611197303459463209521103",
"length": 1848.0
},
"id": "CVE-2025-39967-6929ed51",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_font"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c8ec14075c5317edd6b242f1be8167aa1e4e333",
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"302896299577693567194999087848860257533",
"309336591303083286520722828189795175584",
"187494820890509838907465317410448144934",
"323262172298181026783308476759858074316",
"100939190147029979978530440412157313895"
],
"threshold": 0.9
},
"id": "CVE-2025-39967-755c2a90",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adac90bb1aaf45ca66f9db8ac100be16750ace78",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "2266969192858413235498980771988295124",
"length": 1896.0
},
"id": "CVE-2025-39967-80680265",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_font"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a4bac869560f943edbe3c2b032062f6673b13d3",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "245463253433477630997544021027983732524",
"length": 1925.0
},
"id": "CVE-2025-39967-84a655d2",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_font"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c8ec14075c5317edd6b242f1be8167aa1e4e333",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "328212964552398611197303459463209521103",
"length": 1848.0
},
"id": "CVE-2025-39967-8c9ff1fd",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_font"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "245463253433477630997544021027983732524",
"length": 1925.0
},
"id": "CVE-2025-39967-95191cc4",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_font"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a4bac869560f943edbe3c2b032062f6673b13d3",
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"302896299577693567194999087848860257533",
"309336591303083286520722828189795175584",
"187494820890509838907465317410448144934",
"323262172298181026783308476759858074316",
"68954394609626948046111667643773886277"
],
"threshold": 0.9
},
"id": "CVE-2025-39967-b460e709",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6eb9f423b3db000aaedf83367b8539f6b72dcfc",
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"302896299577693567194999087848860257533",
"309336591303083286520722828189795175584",
"187494820890509838907465317410448144934",
"323262172298181026783308476759858074316",
"68954394609626948046111667643773886277"
],
"threshold": 0.9
},
"id": "CVE-2025-39967-e5b44d5e",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8a6e85328aeb9881531dbe89bcd2637a06c3c95",
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"302896299577693567194999087848860257533",
"309336591303083286520722828189795175584",
"187494820890509838907465317410448144934",
"323262172298181026783308476759858074316",
"68954394609626948046111667643773886277"
],
"threshold": 0.9
},
"id": "CVE-2025-39967-f335aacc",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adac90bb1aaf45ca66f9db8ac100be16750ace78",
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"302896299577693567194999087848860257533",
"309336591303083286520722828189795175584",
"187494820890509838907465317410448144934",
"323262172298181026783308476759858074316",
"68954394609626948046111667643773886277"
],
"threshold": 0.9
},
"id": "CVE-2025-39967-fb389559",
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
}
}
]