The Linux kernel fbdev subsystem had a vulnerability (CVE-2025-40304) where the bit_putcs function lacked proper bounds checking, leading to potential out-of-bounds writes when rendering text near the edges of the framebuffer. Specifically, the function failed to update the character count after clipping the image width to the screen boundary, causing mismatched buffer sizes and out-of-bounds memory writes. The fix involved adding checks to return early if the Y position is off-screen, clipping image height and width to screen boundaries, and updating the character count accordingly to prevent buffer overflows.

This vulnerability allows an attacker with local privileges to cause out-of-bounds memory writes in kernel space, potentially leading to arbitrary code execution, privilege escalation, or system crashes. The CVSS vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H).

A fix has been implemented in the Linux kernel to add proper bounds checking in the bit_putcs function of the fbdev subsystem. Users and administrators should apply the official kernel updates that include this patch. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory or Linux kernel mailing lists for the specific fixed versions and apply updates accordingly.