CVE-2025-39967: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-39967 Overview

CVE-2025-39967 is an integer overflow vulnerability [CWE-190] in the Linux kernel framebuffer console (fbcon) subsystem. The flaw resides in the fbcon_do_set_font() function, where user-controlled font parameters can cause size calculations to overflow. When the CALC_FONTSZ(h, pitch, charcount) macro multiplies attacker-supplied values, the resulting integer wrap produces an allocation smaller than expected. Subsequent font data copying then overflows the undersized buffer, corrupting adjacent kernel memory. The vulnerability affects multiple Linux kernel versions from 5.9 through 6.17 release candidates.

Critical Impact
A local authenticated attacker with access to the framebuffer console interface can trigger a kernel heap buffer overflow, leading to privilege escalation, kernel memory corruption, or system compromise.

Affected Products

Linux Kernel (multiple stable branches prior to patched commits)
Linux Kernel 5.9 (including release candidates rc3 through rc8)
Linux Kernel 6.17 release candidates rc1 through rc7

Discovery Timeline

2025-10-15 - CVE-2025-39967 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-39967

Vulnerability Analysis

The vulnerability exists within the framebuffer console driver's font-setting logic in fbcon_do_set_font(). This function accepts font metadata such as height (h), pitch, and character count (charcount) from user space through the KDFONTOP ioctl interface. The CALC_FONTSZ(h, pitch, charcount) macro performs a three-way multiplication of these values to compute the total buffer size for the font. When these operands are attacker-controlled and sufficiently large, the multiplication wraps around the integer type boundary, producing a truncated small value.

A second overflow path exists in the allocation size computation itself: FONT_EXTRA_WORDS * sizeof(int) + size can wrap when size approaches the maximum representable integer. The kernel then allocates a buffer sized according to the wrapped value, but the subsequent memcpy operation copies data based on the original, larger user-supplied dimensions. This produces a linear heap buffer overflow adjacent to kernel slab objects.

Root Cause

The root cause is missing overflow validation on arithmetic performed with untrusted input before memory allocation. The upstream fix introduces check_mul_overflow() and check_add_overflow() helpers to validate each arithmetic step and fail the operation cleanly when overflow would occur.

Attack Vector

Exploitation requires local access with permissions to invoke the framebuffer console ioctl interface, typically requiring CAP_SYS_TTY_CONFIG or an equivalent capability on the target tty device. An attacker crafts a font-setting request with carefully chosen height, pitch, and charcount values whose product overflows a 32-bit integer. The kernel allocates a small buffer, then copies user-provided font data into it, overwriting adjacent slab memory. Heap grooming techniques can position sensitive kernel objects adjacent to the target allocation to enable privilege escalation.

Verified proof-of-concept code is not publicly available. See the upstream kernel commits linked below for the exact affected code paths.

Detection Methods for CVE-2025-39967

Indicators of Compromise

Unexpected kernel oops or panic messages referencing fbcon_do_set_font or fbcon_set_font in dmesg and /var/log/kern.log.
KASAN (Kernel Address Sanitizer) reports of slab-out-of-bounds writes originating from the fbcon subsystem.
Unprivileged processes issuing KDFONTOP or PIO_FONTX ioctls with unusually large font dimension parameters.

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to surface the out-of-bounds write at exploitation time.
Audit auditd rules to log ioctl syscalls targeting /dev/tty* and /dev/fb* devices, focusing on KDFONTOP requests.
Deploy runtime kernel exploit detection tooling that monitors for unexpected credential structure modifications following font-related syscalls.

Monitoring Recommendations

Monitor kernel logs for warnings emitted by check_mul_overflow() and check_add_overflow() on patched systems, which indicate active exploitation attempts.
Track uid transitions of non-root processes that immediately follow tty ioctl activity, a common signature of local privilege escalation.
Alert on unexpected loading of framebuffer console modules on systems where console fonts are not routinely modified.

How to Mitigate CVE-2025-39967

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the stable tree commits and rebuild or update to a kernel version incorporating the fix.
Restrict access to /dev/tty* and /dev/fb* devices to trusted users only, and audit which processes hold CAP_SYS_TTY_CONFIG.
Prioritize patching on multi-tenant systems, shared workstations, and any host where untrusted local users can execute code.

Patch Information

The fix adds explicit overflow checks using check_mul_overflow() and check_add_overflow() before allocation in fbcon_do_set_font(). Patched commits are available in the stable kernel tree, including Linux Kernel Commit 1a194e6, Linux Kernel Commit 4a4bac8, Linux Kernel Commit 994bdc2, Linux Kernel Commit 9c8ec14, Linux Kernel Commit a6eb9f4, Linux Kernel Commit adac90b, Linux Kernel Commit b8a6e85, and Linux Kernel Commit c0c01f9. Consult your Linux distribution's security advisories for backported package updates.

Workarounds

Blacklist the fbcon module on systems that do not require a framebuffer console by adding blacklist fbcon to /etc/modprobe.d/ configuration.
Remove or restrict permissions on /dev/fb* devices using udev rules to prevent unprivileged access to framebuffer interfaces.
Enforce mandatory access control policies (SELinux or AppArmor) that restrict which processes may issue KDFONTOP ioctls.

bash

# Configuration example: blacklist fbcon and restrict framebuffer access
echo "blacklist fbcon" | sudo tee /etc/modprobe.d/disable-fbcon.conf

# Restrict /dev/fb* to root via udev rule
cat <<EOF | sudo tee /etc/udev/rules.d/99-restrict-fb.rules
KERNEL=="fb[0-9]*", MODE="0600", OWNER="root", GROUP="root"
EOF

sudo udevadm control --reload-rules && sudo udevadm trigger