Memory Management Vulnerability in Linux Kernel fbdev Affects Multiple Distributions

CVE-2025-38214

What is CVE-2025-38214?

A memory management vulnerability in the Linux kernel's fbdev subsystem can lead to a null pointer dereference during framebuffer mode setting. When an attempt is made to add a videomode and memory allocation fails, the function fb_set_var does not revert the fb_info->var to its previous state. This oversight may result in subsequent calls to fb_videomode_to_var failing, causing critical system stability issues. Proper error handling requires that if fb_set_var encounters a failure, it should restore the original fb_info->var as intended.

References