Executive brief
A vulnerability in the Linux kernel's display driver system could allow a local user to crash the system or potentially gain unauthorized access to memory. The issue occurs when the system attempts to draw text near the edges of a screen, failing to properly check if the drawing area stays within the allowed boundaries. This can lead to memory corruption, affecting the stability and security of the operating system.
Technical details
A vmalloc-out-of-bounds write vulnerability exists in the Linux kernel's fbdev core component, specifically within the bit_putcs function in drivers/video/fbdev/core/bitblit.c. The root cause is a lack of sufficient bounds checking when rendering text near screen edges, where the character count (cnt) could remain at its original value while the buffer was allocated based on a clipped width. This mismatch leads to out-of-bounds writes in bit_putcs_aligned and bit_putcs_unaligned. An attacker with local access could exploit this to cause a kernel panic (DoS) or potentially achieve privilege escalation. The issue has been patched across multiple stable branches including 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, and 6.11.y.
Affected products
- Linux Linux Kernel 2.6.12 to 6.12.y
Timeline
- 2025-10-03: other: Vulnerability fixed in source code
- 2025-12-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/15ba9acafb0517f8359ca30002c189a68ddbb939
- https://git.kernel.org/stable/c/1943b69e87b0ab35032d47de0a7fca9a3d1d6fc1
- https://git.kernel.org/stable/c/2d1359e11674ed4274934eac8a71877ae5ae7bbb
- https://git.kernel.org/stable/c/3637d34b35b287ab830e66048841ace404382b67
- https://git.kernel.org/stable/c/86df8ade88d290725554cefd03101ecd0fbd3752
- https://git.kernel.org/stable/c/996bfaa7372d6718b6d860bdf78f6618e850c702
- https://git.kernel.org/stable/c/ebc0730b490c7f27340b1222e01dd106e820320d