In the Linux kernel, the following vulnerability has been resolved:
fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible.
As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vcdoresize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vcdata is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fastimageblit(). This bheviour is excepted only when fgconsole is equal to requested console which is a visible console and updates screen with invalid struct references in fbconputcs().
[
{
"id": "CVE-2025-38685-0fec88d4",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "con2fb_init_display"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56701bf9eeb63219e378cb7fcbd066ea4eaeeb50",
"signature_version": "v1",
"digest": {
"length": 735.0,
"function_hash": "220377928753242519240778928779760183866"
}
},
{
"id": "CVE-2025-38685-135c1fb4",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_disp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56701bf9eeb63219e378cb7fcbd066ea4eaeeb50",
"signature_version": "v1",
"digest": {
"length": 1778.0,
"function_hash": "331112442647293497072568400982927479441"
}
},
{
"id": "CVE-2025-38685-21ee2a8f",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27b118aebdd84161c8ff5ce49d9d536f2af10754",
"signature_version": "v1",
"digest": {
"line_hashes": [
"87830473882524283488334466702699582226",
"127700400118027377170160420188926740923",
"209407470001076474882083367020887637175",
"108615895432367259747716395534262501682",
"59900037506093536965815692902803087901",
"234305790157238402532605632992490976416",
"214255975067961414237081063026745008935",
"137847028617776582668196072676288678906",
"226863924547105679949054562279372857213",
"46431780988978902908118137415458213883",
"337788476406329207351662015414309290559",
"113736762329077639762310676598825255913",
"321152029978028525642728651871181664501",
"279705275028591699192552151563087053065",
"12893164842410673878378103054175716799"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38685-38f024ff",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_disp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af0db3c1f898144846d4c172531a199bb3ca375d",
"signature_version": "v1",
"digest": {
"length": 1778.0,
"function_hash": "331112442647293497072568400982927479441"
}
},
{
"id": "CVE-2025-38685-4488581a",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "con2fb_init_display"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27b118aebdd84161c8ff5ce49d9d536f2af10754",
"signature_version": "v1",
"digest": {
"length": 735.0,
"function_hash": "220377928753242519240778928779760183866"
}
},
{
"id": "CVE-2025-38685-484d3b5f",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c4d7ddaf1d43780b106bedc692679f965dc5a3a",
"signature_version": "v1",
"digest": {
"line_hashes": [
"87830473882524283488334466702699582226",
"127700400118027377170160420188926740923",
"209407470001076474882083367020887637175",
"108615895432367259747716395534262501682",
"59900037506093536965815692902803087901",
"234305790157238402532605632992490976416",
"214255975067961414237081063026745008935",
"137847028617776582668196072676288678906",
"226863924547105679949054562279372857213",
"46431780988978902908118137415458213883",
"337788476406329207351662015414309290559",
"113736762329077639762310676598825255913",
"321152029978028525642728651871181664501",
"279705275028591699192552151563087053065",
"12893164842410673878378103054175716799"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38685-48ad6b0e",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_disp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@078e62bffca4b7e72e8f3550eb063ab981c36c7a",
"signature_version": "v1",
"digest": {
"length": 1782.0,
"function_hash": "126178819099319963583508416012092932254"
}
},
{
"id": "CVE-2025-38685-49da0a48",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af0db3c1f898144846d4c172531a199bb3ca375d",
"signature_version": "v1",
"digest": {
"line_hashes": [
"87830473882524283488334466702699582226",
"127700400118027377170160420188926740923",
"209407470001076474882083367020887637175",
"108615895432367259747716395534262501682",
"59900037506093536965815692902803087901",
"234305790157238402532605632992490976416",
"214255975067961414237081063026745008935",
"137847028617776582668196072676288678906",
"226863924547105679949054562279372857213",
"46431780988978902908118137415458213883",
"337788476406329207351662015414309290559",
"113736762329077639762310676598825255913",
"321152029978028525642728651871181664501",
"279705275028591699192552151563087053065",
"12893164842410673878378103054175716799"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38685-4af4a3b1",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "con2fb_init_display"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af0db3c1f898144846d4c172531a199bb3ca375d",
"signature_version": "v1",
"digest": {
"length": 735.0,
"function_hash": "220377928753242519240778928779760183866"
}
},
{
"id": "CVE-2025-38685-582e3c00",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "con2fb_init_display"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@078e62bffca4b7e72e8f3550eb063ab981c36c7a",
"signature_version": "v1",
"digest": {
"length": 779.0,
"function_hash": "252188693176758486384745706520439725839"
}
},
{
"id": "CVE-2025-38685-612a2947",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_disp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfec17721265e72e50cc69c6004fe3475cd38df2",
"signature_version": "v1",
"digest": {
"length": 1778.0,
"function_hash": "331112442647293497072568400982927479441"
}
},
{
"id": "CVE-2025-38685-73f1e78b",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfec17721265e72e50cc69c6004fe3475cd38df2",
"signature_version": "v1",
"digest": {
"line_hashes": [
"87830473882524283488334466702699582226",
"127700400118027377170160420188926740923",
"209407470001076474882083367020887637175",
"108615895432367259747716395534262501682",
"59900037506093536965815692902803087901",
"234305790157238402532605632992490976416",
"214255975067961414237081063026745008935",
"137847028617776582668196072676288678906",
"226863924547105679949054562279372857213",
"46431780988978902908118137415458213883",
"337788476406329207351662015414309290559",
"113736762329077639762310676598825255913",
"321152029978028525642728651871181664501",
"279705275028591699192552151563087053065",
"12893164842410673878378103054175716799"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38685-776bac64",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@078e62bffca4b7e72e8f3550eb063ab981c36c7a",
"signature_version": "v1",
"digest": {
"line_hashes": [
"87830473882524283488334466702699582226",
"127700400118027377170160420188926740923",
"209407470001076474882083367020887637175",
"108615895432367259747716395534262501682",
"59900037506093536965815692902803087901",
"234305790157238402532605632992490976416",
"214255975067961414237081063026745008935",
"137847028617776582668196072676288678906",
"226863924547105679949054562279372857213",
"46431780988978902908118137415458213883",
"337788476406329207351662015414309290559",
"113736762329077639762310676598825255913",
"321152029978028525642728651871181664501",
"279705275028591699192552151563087053065",
"12893164842410673878378103054175716799"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38685-863863a1",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_disp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed9b8e5016230868c8d813d9179523f729fec8c6",
"signature_version": "v1",
"digest": {
"length": 1778.0,
"function_hash": "331112442647293497072568400982927479441"
}
},
{
"id": "CVE-2025-38685-8b2658d3",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56701bf9eeb63219e378cb7fcbd066ea4eaeeb50",
"signature_version": "v1",
"digest": {
"line_hashes": [
"87830473882524283488334466702699582226",
"127700400118027377170160420188926740923",
"209407470001076474882083367020887637175",
"108615895432367259747716395534262501682",
"59900037506093536965815692902803087901",
"234305790157238402532605632992490976416",
"214255975067961414237081063026745008935",
"137847028617776582668196072676288678906",
"226863924547105679949054562279372857213",
"46431780988978902908118137415458213883",
"337788476406329207351662015414309290559",
"113736762329077639762310676598825255913",
"321152029978028525642728651871181664501",
"279705275028591699192552151563087053065",
"12893164842410673878378103054175716799"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38685-a2ecd52e",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "con2fb_init_display"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfec17721265e72e50cc69c6004fe3475cd38df2",
"signature_version": "v1",
"digest": {
"length": 735.0,
"function_hash": "220377928753242519240778928779760183866"
}
},
{
"id": "CVE-2025-38685-bbc8bc3f",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_disp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c4d7ddaf1d43780b106bedc692679f965dc5a3a",
"signature_version": "v1",
"digest": {
"length": 1778.0,
"function_hash": "331112442647293497072568400982927479441"
}
},
{
"id": "CVE-2025-38685-c1a52d75",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed9b8e5016230868c8d813d9179523f729fec8c6",
"signature_version": "v1",
"digest": {
"line_hashes": [
"87830473882524283488334466702699582226",
"127700400118027377170160420188926740923",
"209407470001076474882083367020887637175",
"108615895432367259747716395534262501682",
"59900037506093536965815692902803087901",
"234305790157238402532605632992490976416",
"214255975067961414237081063026745008935",
"137847028617776582668196072676288678906",
"226863924547105679949054562279372857213",
"46431780988978902908118137415458213883",
"337788476406329207351662015414309290559",
"113736762329077639762310676598825255913",
"321152029978028525642728651871181664501",
"279705275028591699192552151563087053065",
"12893164842410673878378103054175716799"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38685-e2ec1167",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "fbcon_set_disp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27b118aebdd84161c8ff5ce49d9d536f2af10754",
"signature_version": "v1",
"digest": {
"length": 1778.0,
"function_hash": "331112442647293497072568400982927479441"
}
},
{
"id": "CVE-2025-38685-e5646f7e",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "con2fb_init_display"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c4d7ddaf1d43780b106bedc692679f965dc5a3a",
"signature_version": "v1",
"digest": {
"length": 735.0,
"function_hash": "220377928753242519240778928779760183866"
}
},
{
"id": "CVE-2025-38685-e9166a0d",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/video/fbdev/core/fbcon.c",
"function": "con2fb_init_display"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed9b8e5016230868c8d813d9179523f729fec8c6",
"signature_version": "v1",
"digest": {
"length": 735.0,
"function_hash": "220377928753242519240778928779760183866"
}
}
]