CVE-2025-38214

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.10.226

Description: A null pointer dereference issue was found in the Linux kernel's fbdev subsystem. The issue occurs when fb add videomode() fails to allocate memory for fb videomode, leading to a null pointer dereference in fb videomode to var(). This happens because fb info is registered without the expected mode in modelist, which is described in fb info->var. The issue was identified by the Linux Verification Center with Syzkaller.

Recommendations: For Linux kernel versions prior to 5.10.226, update to version 5.10.226 or later to resolve the issue. As a temporary workaround, consider restricting access to the fbdev subsystem to minimize the risk of exploitation. Avoid using the fb set var() function until the issue is resolved.