High 7.8Published Oct 15, 2025

CVE-2025-39967fbcon: fix integer overflow in fbcon_do_set_font

Updated under an hour ago (Oct 27, 2026, 9:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font parameters. The vulnerabilities occur when: 1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount multiplication with user-controlled values that can overflow. 2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow 3. This results in smaller allocations than expected, leading to buffer overflows during font data copying. Add explicit overflow checking using check_mul_overflow() and check_add_overflow() kernel helpers to safety validate all size calculations before allocation.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 96e41fc29e8af5c5085fb8a79cab8d0d00bab86c before 994bdc2d23c79087fbf7dcd9544454e8ebcef877; 39b3cffb8cf3111738ea993e2757ab382253d86a builds before 9c8ec14075c5317edd6b242f1be8167aa1e4e333; from 39b3cffb8cf3111738ea993e2757ab382253d86a before b8a6e85328aeb9881531dbe89bcd2637a06c3c95; from 39b3cffb8cf3111738ea993e2757ab382253d86a before a6eb9f423b3db000aaedf83367b8539f6b72dcfc; from 39b3cffb8cf3111738ea993e2757ab382253d86a before adac90bb1aaf45ca66f9db8ac100be16750ace78; 39b3cffb8cf3111738ea993e2757ab382253d86a builds before 4a4bac869560f943edbe3c2b032062f6673b13d3; from 39b3cffb8cf3111738ea993e2757ab382253d86a before c0c01f9aa08c8e10e10e8c9ebb5be01a4eff6eb7; 39b3cffb8cf3111738ea993e2757ab382253d86a builds before 1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe; and 11 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 4.4.235 before 4.5; from 4.9.235 before 4.10; from 4.14.196 before 4.15; from 4.19.143 before 4.20; from 5.4.62 before 5.4.300; from 5.8.6 before 5.9; from 5.9.1 before 5.10.245; from 5.11 before 5.15.194; and 18 more ranges	NVD

References

References

https://git.kernel.org/stable/c/994bdc2d23c79087fbf7dcd9544454e8ebcef877	patch
https://git.kernel.org/stable/c/9c8ec14075c5317edd6b242f1be8167aa1e4e333	patch
https://git.kernel.org/stable/c/b8a6e85328aeb9881531dbe89bcd2637a06c3c95	patch
https://git.kernel.org/stable/c/a6eb9f423b3db000aaedf83367b8539f6b72dcfc	patch
https://git.kernel.org/stable/c/adac90bb1aaf45ca66f9db8ac100be16750ace78	patch
https://git.kernel.org/stable/c/4a4bac869560f943edbe3c2b032062f6673b13d3	patch
https://git.kernel.org/stable/c/c0c01f9aa08c8e10e10e8c9ebb5be01a4eff6eb7	patch
https://git.kernel.org/stable/c/1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.