{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40304","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.185Z","datePublished":"2025-12-08T00:46:29.013Z","dateUpdated":"2026-08-05T12:09:23.704Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:09:23.704Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds\n\nAdd bounds checking to prevent writes past framebuffer boundaries when\nrendering text near screen edges. Return early if the Y position is off-screen\nand clip image height to screen boundary. Break from the rendering loop if the\nX position is off-screen. When clipping image width to fit the screen, update\nthe character count to match the clipped width to prevent buffer size\nmismatches.\n\nWithout the character count update, bit_putcs_aligned and bit_putcs_unaligned\nreceive mismatched parameters where the buffer is allocated for the clipped\nwidth but cnt reflects the original larger count, causing out-of-bounds writes."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access to the framebuffer character device (`/dev/fbN` ioctls FBIOPUT_CON2FBMAP / FBIOPUT_VSCREENINFO) and/or a virtual console, plus a write to the console to trigger the redraw. There is no remote or network-reachable path into fbcon's glyph blitting.\nAC:L - The reproducer is deterministic — an ioctl puts the VC geometry out of sync with the framebuffer resolution and the very next console redraw performs the out-of-bounds write; syzbot produced a reliable reproducer and confirmed the fix. No race, no memory-layout luck, and no unusual configuration is required (fbcon with DRM fbdev emulation is the default on ordinary systems).\nPR:L - No capability check exists anywhere on the path: `fbcon_set_con2fb_map_ioctl()` and the `FBIOPUT_CON2FBMAP`/`FBIOPUT_VSCREENINFO` handlers perform no `capable()` test, and the VT resize/mode ioctls only require being the owner of the controlling tty. Any unprivileged local user holding the usual graphics/console device access (group `video`, logind uaccess ACLs, Android/kiosk/embedded graphics processes) can reach it.\nUI:N - The attacker performs every step themselves — issue the ioctl to desynchronize the console geometry, then write bytes to their own console fd to force the redraw. No victim action or interaction is needed.\nS:U - The corruption occurs in kernel virtual memory and is exploited to escalate within the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The bug yields an out-of-bounds write with an attacker-influenced offset into the vmalloc region, adjacent to other DRM GEM shmem vmapped buffers and kernel objects, which is readily leveraged into arbitrary kernel memory disclosure (e.g. by corrupting neighbouring buffer pointers/lengths or other clients' graphics buffers that the attacker can mmap).\nI:H - This is a controlled out-of-bounds write: the destination offset is derived from attacker-set VC geometry and font metrics, and the written content is attacker-chosen (console text rendered through a user-supplied font via KDFONTOP), giving a powerful kernel write primitive suitable for privilege escalation.\nA:H - The out-of-bounds write past the vmalloc'd framebuffer corrupts adjacent kernel memory or hits an unmapped guard page, producing a KASAN-confirmed vmalloc-out-of-bounds write and, in production kernels, an oops/panic that can be triggered repeatedly."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/core/bitblit.c"],"versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"996bfaa7372d6718b6d860bdf78f6618e850c702","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f0982400648a3e00580253e0c48e991f34d2684c","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"1943b69e87b0ab35032d47de0a7fca9a3d1d6fc1","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ebc0730b490c7f27340b1222e01dd106e820320d","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"86df8ade88d290725554cefd03101ecd0fbd3752","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"15ba9acafb0517f8359ca30002c189a68ddbb939","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2d1359e11674ed4274934eac8a71877ae5ae7bbb","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3637d34b35b287ab830e66048841ace404382b67","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/video/fbdev/core/bitblit.c"],"versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","status":"unaffected","versionType":"semver"},{"version":"5.4.302","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.247","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.197","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.159","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.117","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.58","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.17.8","lessThanOrEqual":"6.17.*","status":"unaffected","versionType":"semver"},{"version":"6.18","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.4.302"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.10.247"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.197"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.159"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.117"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.12.58"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.17.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.18"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/996bfaa7372d6718b6d860bdf78f6618e850c702"},{"url":"https://git.kernel.org/stable/c/f0982400648a3e00580253e0c48e991f34d2684c"},{"url":"https://git.kernel.org/stable/c/1943b69e87b0ab35032d47de0a7fca9a3d1d6fc1"},{"url":"https://git.kernel.org/stable/c/ebc0730b490c7f27340b1222e01dd106e820320d"},{"url":"https://git.kernel.org/stable/c/86df8ade88d290725554cefd03101ecd0fbd3752"},{"url":"https://git.kernel.org/stable/c/15ba9acafb0517f8359ca30002c189a68ddbb939"},{"url":"https://git.kernel.org/stable/c/2d1359e11674ed4274934eac8a71877ae5ae7bbb"},{"url":"https://git.kernel.org/stable/c/3637d34b35b287ab830e66048841ace404382b67"}],"title":"fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-16T19:54:32.739808Z","id":"CVE-2025-40304","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-06-16T19:54:41.944Z"}}]}}