CVE-2025-38427: video: screen_info: Relocate framebuffers behind PCI bridges
In the Linux kernel, the following vulnerability has been resolved:
video: screeninfo: Relocate framebuffers behind PCI bridges
Apply PCI host-bridge window offsets to screeninfo framebuffers. Fixes invalid access to I/O memory.
Resources behind a PCI host bridge can be relocated by a certain offset in the kernel's CPU address range used for I/O. The framebuffer memory range stored in screeninfo refers to the CPU addresses as seen during boot (where the offset is 0). During boot up, firmware may assign a different memory offset to the PCI host bridge and thereby relocating the framebuffer address of the PCI graphics device as seen by the kernel. The information in screeninfo must be updated as well.
The helper pcibiosbustoresource() performs the relocation of the screeninfo's framebuffer resource (given in PCI bus addresses). The result matches the I/O-memory resource of the PCI graphics device (given in CPU addresses). As before, we store away the information necessary to later update the information in screeninfo itself.
Commit 78aa89d1dfba ("firmware/sysfb: Update screeninfo for relocated EFI framebuffers") added the code for updating screeninfo. It is based on similar functionality that pre-existed in efifb. Efifb uses a pointer to the PCI resource, while the newer code does a memcpy of the region. Hence efifb sees any updates to the PCI resource and avoids the issue.
v3: - Only use struct pcibusregion for PCI bus addresses (Bjorn) - Clarify address semantics in commit messages and comments (Bjorn) v2: - Fixed tags (Takashi, Ivan) - Updated information on efifb
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.35-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.95 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.35 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.15.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1046.49~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1051.57~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1046.53~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1047.50~22.04.2 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-100.100~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1044.44~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-100.100.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1046.49~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1043.44~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-100.100~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1041.42~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-100.100 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1046.49 - Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1046.52 - Upgrade
Upgrade
ubuntu/linux-azure-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1046.53 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1039.42 - Upgrade
Upgrade
ubuntu/linux-azure-nvidia-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1047.50 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1018.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1043.48 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1030.33 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1044.44 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-100.100.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1046.49 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1046.49.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1020.20 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1043.44 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1015.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1047.51 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-34.34.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1023.24 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1016.20 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2037.38 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1041.42 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1046.49+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1046.52+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-100.100+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1047.50+fips1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 78aa89d1dfba
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38427?
CVE-2025-38427 is considered a medium severity vulnerability that affects the Linux kernel.
How do I fix CVE-2025-38427?
To fix CVE-2025-38427, ensure your Linux kernel is updated to a version that includes the patch addressing this vulnerability.
What does CVE-2025-38427 impact?
CVE-2025-38427 impacts the Linux kernel's handling of screen_info and PCI bridges, potentially leading to invalid memory access.
Can CVE-2025-38427 be exploited remotely?
CVE-2025-38427 typically requires local access for exploitation, but it may be leveraged in specific configurations with remote access.
What systems are affected by CVE-2025-38427?
CVE-2025-38427 affects various versions of the Linux kernel used in numerous distributions, particularly those with improper framebuffer implementations.