Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2025-40304

Опубликовано: 08 дек. 2025
Источник: redhat
CVSS3: 7.3
EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes.

A flaw was found in the Linux kernel, specifically within the framebuffer device (fbdev) subsystem. This vulnerability, an out-of-bounds write, occurs because the bit_putcs function does not properly check boundaries when displaying text near the edges of the screen. A local user with low privileges could exploit this to write data beyond the intended memory area. This could potentially lead to serious consequences such as gaining unauthorized access (privilege escalation), revealing sensitive information (information disclosure), or causing the system to become unavailable (denial of service).

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 6kernelNot affected
Red Hat Enterprise Linux 7kernelNot affected
Red Hat Enterprise Linux 7kernel-rtNot affected
Red Hat Enterprise Linux 9kernel-rtAffected
Red Hat Enterprise Linux 10kernelFixedRHSA-2026:228209.02.2026
Red Hat Enterprise Linux 10.0 Extended Update SupportkernelFixedRHSA-2026:172702.02.2026
Red Hat Enterprise Linux 8kernel-rtFixedRHSA-2026:282117.02.2026
Red Hat Enterprise Linux 8kernelFixedRHSA-2026:272016.02.2026
Red Hat Enterprise Linux 8.2 Advanced Update SupportkernelFixedRHSA-2026:266412.02.2026
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportkernelFixedRHSA-2026:336025.02.2026

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-787
https://bugzilla.redhat.com/show_bug.cgi?id=2419870kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service.

EPSS

Процентиль: 16%
0.00053
Низкий

7.3 High

CVSS3

Связанные уязвимости

ubuntu
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes.

nvd
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes.

CVSS3: 5.5
msrc
4 месяца назад

fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

debian
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: f ...

github
4 месяца назад

In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes.

EPSS

Процентиль: 16%
0.00053
Низкий

7.3 High

CVSS3