CVE-2025-40304

A flaw was found in the Linux kernel, specifically within the framebuffer device (fbdev) subsystem. This vulnerability, an out-of-bounds write, occurs because the bit_putcs function does not properly check boundaries when displaying text near the edges of the screen. A local user with low privileges could exploit this to write data beyond the intended memory area. This could potentially lead to serious consequences such as gaining unauthorized access (privilege escalation), revealing sensitive information (information disclosure), or causing the system to become unavailable (denial of service).

This vulnerability is rated as Moderate because exploitation requires local system access and interaction with the virtual console or framebuffer rendering subsystem. Although the out-of-bounds memory write in the framebuffer console layer could potentially lead to kernel crashes or local privilege escalation, triggering the flaw requires specific rendering conditions at display edges. Headless servers and virtualized environments without interactive framebuffer console access face significantly reduced exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.