PT-2025-27990 · Linux+5 · Linux Kernel+5
Published
2025-04-28
·
Updated
2026-04-20
·
CVE-2025-38215
CVSS v2.0
6.0
Medium
| Vector | AV:L/AC:H/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 5.10.226
Description:
A null pointer dereference issue was found in the Linux kernel's fbdev subsystem. The issue occurs when
fb add videomode() fails to allocate memory for fb videomode, leading to a null pointer dereference in fb videomode to var(). This can cause a general protection fault. The issue was discovered by the Linux Verification Center using Syzkaller.Recommendations:
For Linux kernel versions prior to 5.10.226, update to a newer version to resolve the issue. As a temporary workaround, consider disabling the
fb videomode to var() function until a patch is available. Restrict access to the vulnerable fbdev subsystem to minimize the risk of exploitation. Avoid using the fb add videomode() function in the affected do register framebuffer() API endpoint until the issue is resolved.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu