Junglewise Threat Intelligence

CVE-2025-38215: Linux Kernel NULL pointer dereference in fbdev do_register_framebuffer

CVE-2025-38215 · Severity: medium · CVSS 5.5 · Published 2025-07-04

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's framebuffer device (fbdev) component could allow a local user to crash the system. The issue occurs when the system fails to properly handle memory allocation errors during the registration of a display device. This results in a system 'panic' or crash, leading to a denial of service that disrupts operations and requires a reboot.

Technical details

A NULL pointer dereference exists in the fbdev core within the do_register_framebuffer() function. When fb_add_videomode() fails to allocate memory for a new video mode, the kernel continues to register the fb_info structure without the expected mode in its modelist. Subsequent calls to fb_videomode_to_var() attempt to access this missing mode, resulting in a general protection fault. The vulnerability is reachable via local ioctl calls (e.g., FBIOPUT_VSCREENINFO) that trigger screen resizing or mode changes. The fix involves validating the return value of fb_add_videomode() and preventing registration if it fails, while also reordering the registration sequence to simplify error handling.

Affected products

  • Linux Linux Kernel from 2.6.12-rc2 up to 6.1.143, 6.6.95, 6.12.35, 6.15.4

Timeline

  • 2025-04-28: other: Patch authored
  • 2025-07-04: advisory: Initial disclosure and CVE assignment
  • 2025-07-04: patched: Fix merged into stable kernel branches

References

Related threats