Description
In the Linux kernel, the following vulnerability has been resolved:

fbcon: fix integer overflow in fbcon_do_set_font

Fix integer overflow vulnerabilities in fbcon_do_set_font() where font
size calculations could overflow when handling user-controlled font
parameters.

The vulnerabilities occur when:
1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount
multiplication with user-controlled values that can overflow.
2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow
3. This results in smaller allocations than expected, leading to buffer
overflows during font data copying.

Add explicit overflow checking using check_mul_overflow() and
check_add_overflow() kernel helpers to safety validate all size
calculations before allocation.
Published: 2025-10-15
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4379-1 linux-6.1 security update
Debian DLA Debian DLA DLA-4404-1 linux security update
Debian DSA Debian DSA DSA-6053-1 linux security update
Ubuntu USN Ubuntu USN USN-8033-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8033-2 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8033-3 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8034-1 Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN Ubuntu USN USN-8033-4 Linux kernel (AWS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8033-5 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8034-2 Linux kernel (NVIDIA Tegra IGX) vulnerabilities
Ubuntu USN Ubuntu USN USN-8033-6 Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN Ubuntu USN USN-8033-7 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8033-8 Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN Ubuntu USN USN-8095-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8095-2 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8100-1 Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN Ubuntu USN USN-8095-3 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-8095-4 Linux kernel (AWS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8125-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8126-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8095-5 Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN Ubuntu USN USN-8141-1 Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN Ubuntu USN USN-8163-1 Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8165-1 Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8163-2 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8243-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8261-1 Linux kernel (Xilinx) vulnerabilities
History

Thu, 26 Feb 2026 23:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Tue, 03 Feb 2026 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.9:rc8:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc7:*:*:*:*:*:*

Mon, 20 Oct 2025 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Fri, 17 Oct 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 15 Oct 2025 08:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font parameters. The vulnerabilities occur when: 1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount multiplication with user-controlled values that can overflow. 2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow 3. This results in smaller allocations than expected, leading to buffer overflows during font data copying. Add explicit overflow checking using check_mul_overflow() and check_add_overflow() kernel helpers to safety validate all size calculations before allocation.
Title fbcon: fix integer overflow in fbcon_do_set_font
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-11T21:39:53.533Z

Reserved: 2025-04-16T07:20:57.149Z

Link: CVE-2025-39967

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2025-10-15T08:15:34.210

Modified: 2026-02-26T23:06:19.070

Link: CVE-2025-39967

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-10-15T00:00:00Z

Links: CVE-2025-39967 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-10-20T13:26:59Z

Weaknesses