CVE-2025-40322: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40322 is an out-of-bounds read vulnerability in the Linux kernel's framebuffer device (fbdev) bitblit subsystem, specifically in the bit_putcs_aligned() and bit_putcs_unaligned() functions. The flaw was disclosed on December 8, 2025, and affects Linux kernel versions from the initial commit (1da177e4c3f4) up to the fixes introduced in stable releases. Patched versions include kernel 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, and 6.18. It carries a CVSS v3.1 base score of 7.1 (High) with local attack vector and low privileges required (Red Hat CVE, Feedly).

The root cause is improper bounds checking (CWE-125: Out-of-bounds Read) in the fbdev bitblit functions. The glyph pointer is derived from a character value masked by 0xff (for aligned) or 0x1ff (for unaligned), which can produce an index exceeding the actual font's glyph count, causing a read past the end of the built-in font array. The fix clamps the computed index to the actual glyph count before computing the memory address. This global out-of-bounds read was originally reported by syzbot, Google's automated kernel fuzzing infrastructure (Red Hat CVE).

A local attacker with low privileges could trigger the out-of-bounds read to disclose sensitive kernel memory contents (high confidentiality impact) or potentially cause a kernel crash leading to denial of service (high availability impact). Integrity is not directly affected by this read-only flaw. The vulnerability is scoped to the local system and does not inherently enable remote exploitation or direct lateral movement, but kernel memory disclosure could facilitate privilege escalation chaining (Red Hat CVE, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.014% (0.000140), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploit code maturity is rated "Unproven" (Red Hat CVE, Feedly).

Update to a patched Linux kernel version: 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, or 6.18. Distribution-specific patches are available from Red Hat (RHSA-2026:1661, RHSA-2026:1662, RHSA-2026:2282, and others), Ubuntu (USN-8096-1/2/3/5), Debian (DLA-4436-1), AlmaLinux (ALSA-2026-1662), Amazon Linux 2, and Oracle Linux. As a short-term workaround where patching is not immediately possible, restrict local user access to framebuffer devices and limit unprivileged user capabilities on affected systems (Red Hat CVE, Microsoft MSRC).

The vulnerability was reported to the kernel security team via syzbot, Google's automated kernel fuzzer, which identified the global out-of-bounds read. Red Hat rated the issue as having high confidentiality and availability impact. Multiple Linux distributions including Red Hat, Ubuntu, Debian, AlmaLinux, Rocky Linux, Oracle Linux, and Amazon Linux have issued security advisories and patches. No notable independent researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking (Red Hat CVE).