CVE-2025-40322: fbdev: bitblit: bound-check glyph index in bit_putcs*
Vulnerability summary
CVE-2025-40322 is a high (CVSS 7.1) vulnerability in linux. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3.6% of scored vulnerabilities.
Not severe (CVSS 7.1, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 58 · Related 39Timeline
- 08-12-2025PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address. This fixes a global out-of-bounds read reported by syzbot.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.14%
Chance of exploitation in the next 30 days
Percentile
4%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.14% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu154 products
- linuxAll versions (No fix recorded) | < 5.15.0-173.183 | < 6.8.0-106.106 | < 6.17.0-14.14
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1103.110 | < 6.8.0-1050.53 | < 6.17.0-1007.7
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian1 product
- linux< 6.1.159-1 | < 6.12.63-1 | < 6.17.8-1
Linux1 product
- linux≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a10cede006f9614b465cf25609a8753efbfd45cc | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 0998a6cb232674408a03e8561dc15aa266b2f53b | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < db5c9a162d2f42bcc842b76b3d935dcc050a0eec | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < c12003bf91fdff381c55ef54fef3e961a5af2545 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 9ba1a7802ca9a2590cef95b253e6526f4364477f | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 901f44227072be60812fe8083e83e1533c04eed1 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < efaf89a75a29b2d179bf4fe63ca62852e93ad620 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 18c4ef4e765a798b47980555ed665d78b71aeadf | 2.6.12
3 vendors · 156 products
