CVE-2025-38215 is a null-pointer dereference vulnerability in the Linux kernel's fbdev subsystem, specifically affecting the fb_videomode_to_var function. This flaw occurs when fb_add_videomode fails to allocate memory, leading to a system crash (general protection fault) during framebuffer registration. It impacts various Linux distributions, including Debian and Ubuntu. The vulnerability has a CVSS v3.1 score of 5.5 (Medium), indicating a local attack vector with low complexity and a high impact on availability (system crash). There is no confidentiality or integrity impact. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. However, the vulnerability has garnered some community attention with two mentions and two media articles, suggesting awareness within the security community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.6.13, < 6.1.143CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.2, < 6.6.95CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.7, < 6.12.35CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.13, < 6.15.4CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
2.6.12CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Linux kernel (Azure) vulnerabilities
Mar 25, 2026Linux kernel (Azure FIPS) vulnerabilities
Mar 4, 2026Linux kernel (Azure) vulnerabilities
Mar 4, 2026Linux kernel (Xilinx) vulnerabilities
Feb 24, 2026Linux kernel (IBM) vulnerabilities
Feb 24, 2026fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
Jul 8, 2025kernel: fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
Jul 4, 2025