Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2025-40322 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address. This fixes a global out-of-bounds read reported by syzbot.

Metrics

CVSS 3.x Severity and Vector Strings:

NDDVolerionCVSS-B:3.3 LOWVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA: kernel.orgCVSS-B:7.1 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://git.kernel.org/stable/c/0998a6cb232674408a03e8561dc15aa266b2f53b kernel.orgSource CodeVendor
https://git.kernel.org/stable/c/18c4ef4e765a798b47980555ed665d78b71aeadf kernel.orgSource CodeVendor
https://git.kernel.org/stable/c/901f44227072be60812fe8083e83e1533c04eed1 kernel.orgSource CodeVendor
https://git.kernel.org/stable/c/9ba1a7802ca9a2590cef95b253e6526f4364477f kernel.orgSource CodeVendor
https://git.kernel.org/stable/c/a10cede006f9614b465cf25609a8753efbfd45cc kernel.orgSource CodeVendor

see all 8 references

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

ProductVersions
Linux kernel
All versions

CPE

  • cpe:2.3:o:kernel:linux_kernel:*:*:*:*:*:*:*:*
  • cpe:2.3:o:linux:kernel:*:*:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:endpoint_security_linux_threat_prevention:*:*
  • cpe:2.3:a:linux:linux_kernel:*:*:*:*:*:*:*:*

Remediation

Change History

4 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2025-40322
NVD Published Date:
Dec 8, 2025
NVD Last Modified:
Jul 30, 2026
Source:
kernel.org
CVE-2025-40322 Details - Not Deferred