CVE-2025-38215
fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var If fb_add_videomode() in do_register_framebuffer() fails to allocate memory for fb_videomode, it will later lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered while not having the mode in modelist that is expected to be there, i.e. the one that is described in fb_info->var. ================================================================ general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901 Call Trace: display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929 fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071 resize_screen drivers/tty/vt/vt.c:1176 [inline] vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263 fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720 fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776 do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128 fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 ================================================================ Even though fbcon_init() checks beforehand if fb_match_mode() in var_to_display() fails, it can not prevent the panic because fbcon_init() does not return error code. Considering this and the comment in the code about fb_match_mode() returning NULL - "This should not happen" - it is better to prevent registering the fb_info if its mode was not set successfully. Also move fb_add_videomode() closer to the beginning of do_register_framebuffer() to avoid having to do the cleanup on fail. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| Linux Linux |
≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < 908c5bb64f9c4319902b8ca1aa3fef8f83302520 (affected, git) ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < 0909b2b49c4546a7a08c80f53d93736b63270827 (affected, git) ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < 3f2098f4fba7718eb2501207ca6e99d22427f25a (affected, git) ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < d803c4c2a4ac8ce2be6d899d5c7ab0bf7ec355e9 (affected, git) ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < 17186f1f90d34fa701e4f14e6818305151637b9e (affected, git) Other versions: unaffected |
CNA: Linux |
| Linux Linux |
2.6.12 (affected) ≥ 0; < 2.6.12 (unaffected, semver) ≥ 6.1.143; ≤ 6.1.* (unaffected, semver) ≥ 6.6.95; ≤ 6.6.* (unaffected, semver) ≥ 6.12.35; ≤ 6.12.* (unaffected, semver) ≥ 6.15.4; ≤ 6.15.* (unaffected, semver) ≥ 6.16; ≤ * (unaffected, original_commit_for_fix) Other versions: affected |
CNA: Linux |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Siemens |
≥ V3.1.5; < * (affected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Siemens |
≥ V3.1.5; < * (affected, custom)
Other versions: unknown |
ADP: siemens-SADP |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Siemens |
≥ V3.1.5; < * (affected, custom)
Other versions: unknown |
ADP: siemens-SADP |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
No CVSS assessment reported. An unscored record is not a low-severity determination.
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://git.kernel.org/stable/c/908c5bb64f9c4319902b8ca1aa3fef8f83302520CNA: Linux
- https://git.kernel.org/stable/c/0909b2b49c4546a7a08c80f53d93736b63270827CNA: Linux
- https://git.kernel.org/stable/c/3f2098f4fba7718eb2501207ca6e99d22427f25aCNA: Linux
- https://git.kernel.org/stable/c/d803c4c2a4ac8ce2be6d899d5c7ab0bf7ec355e9CNA: Linux
- https://git.kernel.org/stable/c/17186f1f90d34fa701e4f14e6818305151637b9eCNA: Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlADP: CVE
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlADP: siemens-SADP
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.