CVE-2022-50511

lib/fonts: fix undefined behavior in bit shift for get_default_font

published October 7, 2025

CVSS
—
EPSS
0%
Percentile
4.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

lib/fonts: fix undefined behavior in bit shift for get_default_font

Shifting signed 32-bit value by 31 bits is undefined, so changing

significant bit to unsigned. The UBSAN warning calltrace like below:

UBSAN: shift-out-of-bounds in lib/fonts/fonts.c:139:20

left shift of 1 by 31 places cannot be represented in type 'int'

<TASK>

dump_stack_lvl+0x7d/0xa5

dump_stack+0x15/0x1b

ubsan_epilogue+0xe/0x4e

__ubsan_handle_shift_out_of_bounds+0x1e7/0x20c

get_default_font+0x1c7/0x1f0

fbcon_startup+0x347/0x3a0

do_take_over_console+0xce/0x270

do_fbcon_takeover+0xa1/0x170

do_fb_registered+0x2a8/0x340

fbcon_fb_registered+0x47/0xe0

register_framebuffer+0x294/0x4a0

__drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_helper]

drm_fb_helper_initial_config+0x52/0x80 [drm_kms_helper]

drm_fbdev_client_hotplug+0x156/0x1b0 [drm_kms_helper]

drm_fbdev_generic_setup+0xfc/0x290 [drm_kms_helper]

bochs_pci_probe+0x6ca/0x772 [bochs]

local_pci_probe+0x4d/0xb0

pci_device_probe+0x119/0x320

really_probe+0x181/0x550

__driver_probe_device+0xc6/0x220

driver_probe_device+0x32/0x100

__driver_attach+0x195/0x200

bus_for_each_dev+0xbb/0x120

driver_attach+0x27/0x30

bus_add_driver+0x22e/0x2f0

driver_register+0xa9/0x190

__pci_register_driver+0x90/0xa0

bochs_pci_driver_init+0x52/0x1000 [bochs]

do_one_initcall+0x76/0x430

do_init_module+0x61/0x28a

load_module+0x1f82/0x2e50

__do_sys_finit_module+0xf8/0x190

__x64_sys_finit_module+0x23/0x30

do_syscall_64+0x58/0x80

entry_SYSCALL_64_after_hwframe+0x63/0xcd

</TASK>

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00157 · 4.5th percentile
Published
2025-10-07T15:19Z
EPSS history
Timeline
  • 07 OCT 15:19Z
    lib/fonts: fix undefined behavior in bit shift for get_default_font
    cvelistv5