CVE-2025-38214: fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
fbdev: Fix fbsetvar to prevent null-ptr-deref in fbvideomodetovar
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In fb_set_var(), restore the old fb_info->var value when fb_add_videomode() fails to allocate memory or fails to add the mode to fb_info->modelist, using the same restoration method performed earlier in the function.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38214?
The severity of CVE-2025-38214 is rated as medium due to the potential for a null pointer dereference in the Linux kernel.
How do I fix CVE-2025-38214?
To fix CVE-2025-38214, update your Linux kernel to the latest version that includes the patch addressing this vulnerability.
What systems are affected by CVE-2025-38214?
CVE-2025-38214 affects the Linux kernel across various distributions that utilize the fbdev subsystem.
What is the impact of CVE-2025-38214 on system performance?
The impact of CVE-2025-38214 can lead to system crashes or instability due to a potential null pointer dereference.
Is there a known exploit for CVE-2025-38214?
As of now, there are no public exploits known for CVE-2025-38214, but users are advised to apply patches promptly.