CVE-2025-38215

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.10.226

Description: A null pointer dereference issue was found in the Linux kernel's fbdev subsystem. The issue occurs when fb add videomode() fails to allocate memory for fb videomode, leading to a null pointer dereference in fb videomode to var(). This can cause a general protection fault. The issue was discovered by the Linux Verification Center using Syzkaller.

Recommendations: For Linux kernel versions prior to 5.10.226, update to a newer version to resolve the issue. As a temporary workaround, consider disabling the fb videomode to var() function until a patch is available. Restrict access to the vulnerable fbdev subsystem to minimize the risk of exploitation. Avoid using the fb add videomode() function in the affected do register framebuffer() API endpoint until the issue is resolved.