Executive brief
A vulnerability in the Linux kernel's framebuffer device (fbdev) component could allow a local user to crash the system. The issue occurs when the system fails to properly handle memory allocation errors during display mode changes. This results in a system instability or a 'kernel panic,' potentially disrupting operations or causing a denial of service on the affected machine.
Technical details
A NULL pointer dereference exists in the Linux kernel's fbdev core, specifically within the fb_set_var function. The vulnerability is triggered when fb_add_videomode() fails to allocate memory for a new video mode. In this failure scenario, fb_set_var() fails to restore the original state of fb_info->var, leaving the structure in an inconsistent state. Subsequent calls to fb_videomode_to_var() attempt to access a mode that was never successfully added to the modelist, resulting in a NULL pointer dereference and a general protection fault. This can be reached via ioctl calls on the framebuffer device. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel from 2.6.12-rc2 before 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4
Timeline
- 2025-07-04: advisory: Initial publication date
- 2025-04-28: patched: Fix authored by Murad Masimov
References
- https://git.kernel.org/stable/c/05f6e183879d9785a3cdf2f08a498bc31b7a20aa
- https://git.kernel.org/stable/c/1a10d91766eb6ddfd5414e4785611e33a4fe0f9b
- https://git.kernel.org/stable/c/3ca78032a388a0795201792b36e6fc9b6e6e8eed
- https://git.kernel.org/stable/c/8a3a2887794b2c8e78b3e5d6e3de724527c9f41b
- https://git.kernel.org/stable/c/b3071bb463ea1e6c686d0dc9638fc940f2f5cf17
- https://git.kernel.org/stable/c/ee20216f12d9482cd70e44dae5e7fabb38367c71
- https://git.kernel.org/stable/c/fab201d72fde38d081e2c5d4ad25595c535b7b22