In the Linux kernel, the following vulnerability has been resolved:
fbdev: core: fbcvt: avoid division by 0 in fbcvthperiod()
In fbfindmodecvt(), iff mode->refresh somehow happens to be 0x80000000, cvt.frefresh will become 0 when multiplying it by 2 due to overflow. It's then passed to fbcvthperiod(), where it's used as a divider -- division by 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to avoid such overflow...
Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool.
[ { "signature_type": "Line", "id": "CVE-2025-38312-25dfa510", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53784073cbad18f75583fd3da9ffdfc4d1f05405", "signature_version": "v1", "target": { "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "60234128055958498235867951853724018079", "319378828652993916162741083069799520107", "37723575366235501019764820287802802935", "47285114334427599990974938661413707470" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38312-34d6c111", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab91647acdf43b984824776559a452212eaeb21a", "signature_version": "v1", "target": { "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "60234128055958498235867951853724018079", "319378828652993916162741083069799520107", "37723575366235501019764820287802802935", "47285114334427599990974938661413707470" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38312-384a058c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54947530663edcbaaee1314c01fdd8c72861b124", "signature_version": "v1", "target": { "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "60234128055958498235867951853724018079", "319378828652993916162741083069799520107", "37723575366235501019764820287802802935", "47285114334427599990974938661413707470" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38312-3d266475", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f6dae09fc8c306eb70fdfef70726e1f154e173a", "signature_version": "v1", "target": { "function": "fb_find_mode_cvt", "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "function_hash": "203210037482484360745727041162312490291", "length": 2111.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38312-43d143a0", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@54947530663edcbaaee1314c01fdd8c72861b124", "signature_version": "v1", "target": { "function": "fb_find_mode_cvt", "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "function_hash": "203210037482484360745727041162312490291", "length": 2111.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38312-4a8eaee1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d63433e8eaa3c91b2948190e395bc67009db0d9", "signature_version": "v1", "target": { "function": "fb_find_mode_cvt", "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "function_hash": "203210037482484360745727041162312490291", "length": 2111.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38312-62f6bebc", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f6dae09fc8c306eb70fdfef70726e1f154e173a", "signature_version": "v1", "target": { "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "60234128055958498235867951853724018079", "319378828652993916162741083069799520107", "37723575366235501019764820287802802935", "47285114334427599990974938661413707470" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38312-6c86a073", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@610f247f2772e4f92b63442125a1b7ade79898d8", "signature_version": "v1", "target": { "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "60234128055958498235867951853724018079", "319378828652993916162741083069799520107", "37723575366235501019764820287802802935", "47285114334427599990974938661413707470" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38312-71d3cb3d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9027ce4c037b566b658b8939a76326b7125e3627", "signature_version": "v1", "target": { "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "60234128055958498235867951853724018079", "319378828652993916162741083069799520107", "37723575366235501019764820287802802935", "47285114334427599990974938661413707470" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38312-92e4110e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab91647acdf43b984824776559a452212eaeb21a", "signature_version": "v1", "target": { "function": "fb_find_mode_cvt", "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "function_hash": "203210037482484360745727041162312490291", "length": 2111.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38312-b587f688", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b235393b9f43ff86a38ca2bde6372312ea215dc5", "signature_version": "v1", "target": { "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "60234128055958498235867951853724018079", "319378828652993916162741083069799520107", "37723575366235501019764820287802802935", "47285114334427599990974938661413707470" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38312-b9f8003d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9027ce4c037b566b658b8939a76326b7125e3627", "signature_version": "v1", "target": { "function": "fb_find_mode_cvt", "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "function_hash": "203210037482484360745727041162312490291", "length": 2111.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2025-38312-baba0806", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d63433e8eaa3c91b2948190e395bc67009db0d9", "signature_version": "v1", "target": { "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "60234128055958498235867951853724018079", "319378828652993916162741083069799520107", "37723575366235501019764820287802802935", "47285114334427599990974938661413707470" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38312-bbfcc364", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@610f247f2772e4f92b63442125a1b7ade79898d8", "signature_version": "v1", "target": { "function": "fb_find_mode_cvt", "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "function_hash": "203210037482484360745727041162312490291", "length": 2111.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38312-d1a5ad06", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53784073cbad18f75583fd3da9ffdfc4d1f05405", "signature_version": "v1", "target": { "function": "fb_find_mode_cvt", "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "function_hash": "203210037482484360745727041162312490291", "length": 2111.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2025-38312-e20a0a6b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b235393b9f43ff86a38ca2bde6372312ea215dc5", "signature_version": "v1", "target": { "function": "fb_find_mode_cvt", "file": "drivers/video/fbdev/core/fbcvt.c" }, "digest": { "function_hash": "203210037482484360745727041162312490291", "length": 2111.0 }, "deprecated": false } ]