Integer Overflow Vulnerability in Linux Kernel Affecting Font Management

CVE-2025-39967

What is CVE-2025-39967?

This vulnerability in the Linux kernel occurs within the fbcon_do_set_font() function, where font size calculations are susceptible to integer overflows due to multiplication involving user-controlled parameters. Specifically, the formula CALC_FONTSZ(h, pitch, charcount) can yield unexpected results if the input values are not appropriately validated. Additionally, operations involving FONT_EXTRA_WORDS and size calculations may also trigger overflows. Such miscalculations can result in insufficient memory allocation, allowing for buffer overflows during the copying of font data. Kernel developers have mitigated this issue by implementing explicit overflow checks using the check_mul_overflow() and check_add_overflow() helper functions to ensure all relevant size calculations are securely validated prior to memory allocation.

References