Executive brief
A vulnerability in the Linux kernel's framebuffer device (fbdev) component could allow a local user to crash the system. The issue occurs when the system fails to properly handle memory allocation errors during the registration of a display device. This results in a system 'panic' or crash, leading to a denial of service that disrupts operations and requires a reboot.
Technical details
A NULL pointer dereference exists in the fbdev core within the do_register_framebuffer() function. When fb_add_videomode() fails to allocate memory for a new video mode, the kernel continues to register the fb_info structure without the expected mode in its modelist. Subsequent calls to fb_videomode_to_var() attempt to access this missing mode, resulting in a general protection fault. The vulnerability is reachable via local ioctl calls (e.g., FBIOPUT_VSCREENINFO) that trigger screen resizing or mode changes. The fix involves validating the return value of fb_add_videomode() and preventing registration if it fails, while also reordering the registration sequence to simplify error handling.
Affected products
- Linux Linux Kernel from 2.6.12-rc2 up to 6.1.143, 6.6.95, 6.12.35, 6.15.4
Timeline
- 2025-04-28: other: Patch authored
- 2025-07-04: advisory: Initial disclosure and CVE assignment
- 2025-07-04: patched: Fix merged into stable kernel branches
References
- https://git.kernel.org/stable/c/0909b2b49c4546a7a08c80f53d93736b63270827
- https://git.kernel.org/stable/c/17186f1f90d34fa701e4f14e6818305151637b9e
- https://git.kernel.org/stable/c/3f2098f4fba7718eb2501207ca6e99d22427f25a
- https://git.kernel.org/stable/c/908c5bb64f9c4319902b8ca1aa3fef8f83302520
- https://git.kernel.org/stable/c/d803c4c2a4ac8ce2be6d899d5c7ab0bf7ec355e9
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html