Executive brief
A vulnerability in the Linux kernel's display driver core could allow a local user to crash the system. The issue occurs when the system processes specific video timing parameters, leading to a mathematical error that stops the operating system. This could result in a denial-of-service, impacting system availability and ongoing operations.
Technical details
A division-by-zero vulnerability exists in the fbdev core within the fb_cvt_hperiod() function. In fb_find_mode_cvt(), if the mode refresh rate is set to 0x80000000, an integer overflow occurs when the value is multiplied by 2, resulting in cvt.f_refresh becoming 0. This zero value is subsequently used as a divisor in fb_cvt_hperiod(), triggering a kernel oops. The vulnerability is reachable by local users with sufficient privileges to modify or set video modes. Patches have been released across multiple stable kernel branches to add a sanity check for cvt.f_refresh.
Affected products
- Linux Linux Kernel 2.6.14 to 5.4.295, 5.5 to 5.10.239, 5.11 to 5.15.186, 5.16 to 6.1.142, 6.2 to 6.6.94, 6.7 to 6.12.34, 6.13 to 6.15.3
Timeline
- 2025-07-10: disclosed
- 2025-07-10: advisory
- 2025-05-31: patched: Initial patch in main kernel tree
References
- https://git.kernel.org/stable/c/2d63433e8eaa3c91b2948190e395bc67009db0d9
- https://git.kernel.org/stable/c/3f6dae09fc8c306eb70fdfef70726e1f154e173a
- https://git.kernel.org/stable/c/53784073cbad18f75583fd3da9ffdfc4d1f05405
- https://git.kernel.org/stable/c/54947530663edcbaaee1314c01fdd8c72861b124
- https://git.kernel.org/stable/c/610f247f2772e4f92b63442125a1b7ade79898d8
- https://git.kernel.org/stable/c/9027ce4c037b566b658b8939a76326b7125e3627
- https://git.kernel.org/stable/c/ab91647acdf43b984824776559a452212eaeb21a