Executive brief
A vulnerability exists in the Linux kernel's framebuffer device driver, which handles how text and graphics are displayed on certain monitors. An attacker with local access to the system could trigger a memory error that might lead to a system crash or the exposure of sensitive information from the computer's memory. This issue affects systems using specific older display technologies or console drivers.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's fbdev bitblit component within the bit_putcs_aligned() and bit_putcs_unaligned() functions. The root cause is that the glyph pointer is derived from a character value masked by 0xff or 0x1ff without verifying if the resulting index exceeds the actual font's glyph count. A local attacker can exploit this to read past the end of the built-in font array. This can result in a kernel oops (denial of service) or the disclosure of sensitive information from global kernel memory. The issue has been patched by clamping the index to the actual glyph count before address computation.
Affected products
- Linux Linux 2.6.12 to 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.104, 6.12.4, 6.13-rc1
Timeline
- 2025-10-20: other: Patch authored
- 2025-12-07: patched: Patch committed to stable tree
- 2025-12-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0998a6cb232674408a03e8561dc15aa266b2f53b
- https://git.kernel.org/stable/c/18c4ef4e765a798b47980555ed665d78b71aeadf
- https://git.kernel.org/stable/c/901f44227072be60812fe8083e83e1533c04eed1
- https://git.kernel.org/stable/c/9ba1a7802ca9a2590cef95b253e6526f4364477f
- https://git.kernel.org/stable/c/a10cede006f9614b465cf25609a8753efbfd45cc
- https://git.kernel.org/stable/c/c12003bf91fdff381c55ef54fef3e961a5af2545
- https://git.kernel.org/stable/c/db5c9a162d2f42bcc842b76b3d935dcc050a0eec