CVE-2025-39967

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fbcon: fix integer overflow in fbcon_do_set_font<br /> <br /> Fix integer overflow vulnerabilities in fbcon_do_set_font() where font<br /> size calculations could overflow when handling user-controlled font<br /> parameters.<br /> <br /> The vulnerabilities occur when:<br /> 1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount<br /> multiplication with user-controlled values that can overflow.<br /> 2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow<br /> 3. This results in smaller allocations than expected, leading to buffer<br /> overflows during font data copying.<br /> <br /> Add explicit overflow checking using check_mul_overflow() and<br /> check_add_overflow() kernel helpers to safety validate all size<br /> calculations before allocation.