Search: CVE-2025-40322

A high-severity vulnerability in the Linux kernel's framebuffer device (fbdev) bitblit code was resolved. The issue involved out-of-bounds reads caused by improper bound-checking of glyph indices in the bit_putcs_aligned() and bit_putcs_unaligned() functions. These functions derived glyph pointers from character values masked by 0xff or 0x1ff, which could exceed the actual font's glyph count, leading to reads past the end of the font array. The fix clamps the glyph index to the actual glyph count to prevent this out-of-bounds access. This vulnerability was identified and reported by syzbot. No known exploits are reported in the wild.