CVE-2025-38312: fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
In the Linux kernel, the following vulnerability has been resolved:
fbdev: core: fbcvt: avoid division by 0 in fbcvthperiod()
In fbfindmodecvt(), iff mode->refresh somehow happens to be 0x80000000, cvt.frefresh will become 0 when multiplying it by 2 due to overflow. It's then passed to fbcvthperiod(), where it's used as a divider -- division by 0 will result in kernel oops. Add a sanity check for cvt.frefresh to avoid such overflow...
Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In fb_find_mode_cvt(), when mode->refresh == 0x80000000 causes cvt.f_refresh to overflow such that it becomes 0 (after multiplying by 2), add a sanity check in fb_cvt_hperiod() to prevent division by 0 by rejecting/handling cvt.f_refresh==0 before it is used as a divider.
Linux kernel fbdev (fb_cvt_hperiod / fb_find_mode_cvt) cvt.f_refresh = Validate cvt.f_refresh != 0 before use as a divider (add sanity check)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38312?
The severity of CVE-2025-38312 is considered to be medium due to potential denial of service risks associated with the division by zero condition.
How do I fix CVE-2025-38312?
To fix CVE-2025-38312, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What versions of the Linux Kernel are affected by CVE-2025-38312?
CVE-2025-38312 affects various versions of the Linux Kernel prior to the patch being applied; it is best to refer to your specific kernel version for details.
What components are involved in CVE-2025-38312?
CVE-2025-38312 involves the fbdev subsystem specifically the fb_cvt_hperiod() function, which leads to issues with framebuffer mode setting.
Is CVE-2025-38312 a critical vulnerability?
CVE-2025-38312 is not classified as critical, but it can lead to unexpected behavior and should be mitigated promptly.