CVE-2025-40304: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
Vulnerability summary
CVE-2025-40304 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3.7% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 58 · Related 39Timeline
- 08-12-2025PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.14%
Chance of exploitation in the next 30 days
Percentile
4%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.14% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu153 products
- linuxAll versions (No fix recorded) | < 5.15.0-173.183 | < 6.8.0-106.106 | < 6.17.0-14.14
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1103.110 | < 6.8.0-1050.53 | < 6.17.0-1007.7
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian1 product
- linux< 6.1.159-1 | < 6.12.63-1 | < 6.17.8-1
Linux1 product
- linux≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 996bfaa7372d6718b6d860bdf78f6618e850c702 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < f0982400648a3e00580253e0c48e991f34d2684c | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 1943b69e87b0ab35032d47de0a7fca9a3d1d6fc1 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < ebc0730b490c7f27340b1222e01dd106e820320d | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 86df8ade88d290725554cefd03101ecd0fbd3752 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 15ba9acafb0517f8359ca30002c189a68ddbb939 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 2d1359e11674ed4274934eac8a71877ae5ae7bbb | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 3637d34b35b287ab830e66048841ace404382b67 | 2.6.12
3 vendors · 155 products
