Junglewise Threat Intelligence

CVE-2025-38214: Linux Kernel fbdev NULL pointer dereference in fb_set_var

CVE-2025-38214 · Severity: medium · CVSS 5.5 · Published 2025-07-04

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's framebuffer device (fbdev) component could allow a local user to crash the system. The issue occurs when the system fails to properly handle memory allocation errors during display mode changes. This results in a system instability or a 'kernel panic,' potentially disrupting operations or causing a denial of service on the affected machine.

Technical details

A NULL pointer dereference exists in the Linux kernel's fbdev core, specifically within the fb_set_var function. The vulnerability is triggered when fb_add_videomode() fails to allocate memory for a new video mode. In this failure scenario, fb_set_var() fails to restore the original state of fb_info->var, leaving the structure in an inconsistent state. Subsequent calls to fb_videomode_to_var() attempt to access a mode that was never successfully added to the modelist, resulting in a NULL pointer dereference and a general protection fault. This can be reached via ioctl calls on the framebuffer device. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel from 2.6.12-rc2 before 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4

Timeline

  • 2025-07-04: advisory: Initial publication date
  • 2025-04-28: patched: Fix authored by Murad Masimov

References

Related threats