CVE-2025-39967

In the Linux kernel, the following vulnerability has been resolved:

fbcon: fix integer overflow in fbcon_do_set_font

Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font parameters.

The vulnerabilities occur when:

1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount multiplication with user-controlled values that can overflow.
2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow
3. This results in smaller allocations than expected, leading to buffer overflows during font data copying.

Add explicit overflow checking using check_mul_overflow() and check_add_overflow() kernel helpers to safety validate all size calculations before allocation.

This vulnerability is rated as having a Moderate impact because exploitation is restricted to local attack vectors and typically requires elevated privileges to interact with the virtual terminal console subsystems. In standard Red Hat Enterprise Linux deployments, particularly within cloud and headless server environments, the framebuffer console interface is not exposed to untrusted users. Because the flaw cannot be triggered across a network, the overall attack surface and blast radius are substantially limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.