{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"b3237d451bf3a4490cb1a76f3b7c91d9888f1c4b","status":"affected","version":"409d6c95f9c68bb7046410a3502e26e454a1e636","versionType":"git"},{"lessThan":"519ba75728ee8cd561dce25fc52a2ec5c47171dc","status":"affected","version":"409d6c95f9c68bb7046410a3502e26e454a1e636","versionType":"git"},{"lessThan":"f28f1f578cd810779d01999c60618cda14c281dd","status":"affected","version":"409d6c95f9c68bb7046410a3502e26e454a1e636","versionType":"git"},{"lessThan":"54b28f7c567dd659e5f9562f518e4d7f3f6a367b","status":"affected","version":"409d6c95f9c68bb7046410a3502e26e454a1e636","versionType":"git"},{"lessThan":"cedc1b63394a866bf8663a3e40f4546f1d28c8d8","status":"affected","version":"409d6c95f9c68bb7046410a3502e26e454a1e636","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.142","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.95","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.35","versionType":"semver"},{"lessThanOrEqual":"6.15.*","status":"unaffected","version":"6.15.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.16","versionType":"original_commit_for_fix"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]}],"cveId":"CVE-2025-38198","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Make sure modelist not set on unregistered console\n\nIt looks like attempting to write to the \"store_modes\" sysfs node will\nrun afoul of unregistered consoles:\n\nUBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28\nindex -1 is out of range for type 'fb_info *[32]'\n...\n fbcon_info_from_console+0x192/0x1a0 drivers/video/fbdev/core/fbcon.c:122\n fbcon_new_modelist+0xbf/0x2d0 drivers/video/fbdev/core/fbcon.c:3048\n fb_new_modelist+0x328/0x440 drivers/video/fbdev/core/fbmem.c:673\n store_modes+0x1c9/0x3e0 drivers/video/fbdev/core/fbsysfs.c:113\n dev_attr_store+0x55/0x80 drivers/base/core.c:2439\n\nstatic struct fb_info *fbcon_registered_fb[FB_MAX];\n...\nstatic signed char con2fb_map[MAX_NR_CONSOLES];\n...\nstatic struct fb_info *fbcon_info_from_console(int console)\n...\n        return fbcon_registered_fb[con2fb_map[console]];\n\nIf con2fb_map contains a -1 things go wrong here. Instead, return NULL,\nas callers of fbcon_info_from_console() are trying to compare against\nexisting \"info\" pointers, so error handling should kick in correctly.","epss":{"date":"2026-11-05","percentile":0.08526,"score":0.00188},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793911938923,"publishedAt":1751636240588,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/b3237d451bf3a4490cb1a76f3b7c91d9888f1c4b"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/519ba75728ee8cd561dce25fc52a2ec5c47171dc"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/f28f1f578cd810779d01999c60618cda14c281dd"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/54b28f7c567dd659e5f9562f518e4d7f3f6a367b"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/cedc1b63394a866bf8663a3e40f4546f1d28c8d8"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}],"remediation":[],"revision":"4801dfb3cdaa5d4485f9c05fdce9528b550cf7e0e6362c0ffe586489dfba9bc3","sources":[{"modifiedAt":1793911938923,"name":"CNA: Linux","retrievedAt":1793913609764,"url":"https://www.cve.org/CVERecord?id=CVE-2025-38198"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793913636798,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-38198"}],"ssvc":{"assessedAt":1793911859496,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"fbcon: Make sure modelist not set on unregistered console","updatedAt":1793913636798}