CVE-2025-40304
Linux Kernel vulnerability analysis and mitigation

Overview

CVE-2025-40304 is an out-of-bounds write vulnerability in the Linux kernel's framebuffer device (fbdev) subsystem, specifically in the bit_putcs function responsible for rendering text on screen. The flaw arises from missing bounds checking when rendering text near screen edges, causing bit_putcs_aligned and bit_putcs_unaligned to receive mismatched parameters — the buffer is allocated for a clipped width but the character count (cnt) reflects the original larger value, leading to vmalloc-out-of-bounds writes. It was published on December 8, 2025, and affects the Linux kernel across a wide range of stable versions. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

Technical details

The root cause is classified as CWE-787 (Out-of-bounds Write). The vulnerability exists in drivers/video/fbdev/core/bitblit.c within the bit_putcs function: when an image is clipped to fit the screen width, the image width is reduced but the character count variable cnt is not updated to match, creating a buffer size mismatch. The functions bit_putcs_aligned and bit_putcs_unaligned then use the stale cnt value to drive rendering loops, writing beyond the allocated vmalloc buffer. Exploitation requires local access with low privileges and no user interaction. Patches are available across multiple stable kernel branches via the kernel stable tree (Red Hat CVE).

Impact

Successful exploitation can cause memory corruption in kernel vmalloc space, potentially leading to a system crash (denial of service) or, in more sophisticated scenarios, arbitrary kernel code execution. The primary confirmed impact is high availability loss (system crash/kernel panic); confidentiality and integrity impacts are theoretically possible through memory corruption but are not the primary concern given the CVSS scoring. The vulnerability is locally scoped and does not enable direct network-based exploitation or lateral movement (Red Hat CVE, Feedly).

Exploitability

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability requires local low-privilege access to trigger, limiting its attack surface. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Mitigation and workarounds

The Linux kernel maintainers have released patches across all affected stable branches. Administrators should update to the following patched versions or later: 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, or 6.18 (Feedly). Distribution-specific updates are available from Red Hat (RHSA-2026:1727, RHSA-2026:2282, RHSA-2026:2490, and others), Ubuntu (USN-8096-1/2/3/5), Debian (DLA-4436-1), Amazon Linux, Oracle Linux, and AlmaLinux/Rocky Linux. As a workaround where patching is not immediately possible, restricting local user access to framebuffer devices (e.g., via permissions on /dev/fb*) can reduce exposure (Red Hat Advisory, Ubuntu Advisory).

Additional resources


SourceThis report was generated using AI

Related Linux Kernel vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-74732NONEN/A
  • Linux Kernel logoLinux Kernel
  • kernel-firmware
NoYesAug 22, 2026
CVE-2026-74730NONEN/A
  • Linux Kernel logoLinux Kernel
  • kernel-debug-devel
NoYesAug 22, 2026
CVE-2026-74726NONEN/A
  • Linux Kernel logoLinux Kernel
  • kernel-64k-debug-modules
NoYesAug 22, 2026
CVE-2026-74719NONEN/A
  • Linux Kernel logoLinux Kernel
  • kernel-64k-modules-partner
NoYesAug 22, 2026
CVE-2026-74717NONEN/A
  • Linux Kernel logoLinux Kernel
  • rtla
NoYesAug 22, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management