PT-2025-27989 · Linux+6 · Linux Kernel+6
Published
2025-04-28
·
Updated
2026-04-20
·
CVE-2025-38214
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 5.10.226
Description:
A null pointer dereference issue was found in the Linux kernel's fbdev subsystem. The issue occurs when
fb add videomode() fails to allocate memory for fb videomode, leading to a null pointer dereference in fb videomode to var(). This happens because fb info is registered without the expected mode in modelist, which is described in fb info->var. The issue was identified by the Linux Verification Center with Syzkaller.Recommendations:
For Linux kernel versions prior to 5.10.226, update to version 5.10.226 or later to resolve the issue. As a temporary workaround, consider restricting access to the
fbdev subsystem to minimize the risk of exploitation. Avoid using the fb set var() function until the issue is resolved.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu