CVE-2025-38198: fbcon: Make sure modelist not set on unregistered console
Published Jul 4, 2025
·Updated
fbcon: Make sure modelist not set on unregistered console
Affected Software
9 affected componentsFixes available
Linux Linux kernel
Microsoft cbl2 kernel 5.15.186.1-1
Microsoft azl3 kernel 6.6.92.2-2
Linux Linux kernel<6.1.142
Linux Linux kernel>=6.2<6.6.95
Linux Linux kernel>=6.7<6.12.35
Linux Linux kernel>=6.13<6.15.4
Debian Debian Linux=11.0
debian/linux
6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-17.2.13-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Jul 4, 2025
CVE Published
via MITRE·01:37 PM
Data Sourced
via MITRE·01:37 PM
Description
Data Sourced
via NVD·02:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Aug 7, 2025
Data Sourced
via Microsoft·12:00 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-38198?
CVE-2025-38198 has been classified as a medium severity vulnerability in the Linux kernel.
2
How do I fix CVE-2025-38198?
To fix CVE-2025-38198, update the Linux kernel to the latest patched version.
3
What are the consequences of exploiting CVE-2025-38198?
Exploiting CVE-2025-38198 could lead to unexpected behavior or crashes in the Linux kernel due to unregistered console access.
4
Which Linux kernel versions are affected by CVE-2025-38198?
CVE-2025-38198 affects multiple versions of the Linux kernel, specifically those prior to the security patch release.
5
Is CVE-2025-38198 related to console management in Linux?
Yes, CVE-2025-38198 specifically concerns the handling of the 'store_modes' sysfs node and unregistered consoles.