Improper error handling in Linux kernel fbdev core driver

1) Improper error handling

EUVDB-ID: #VU112318

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-38214

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the fb_set_var() function in drivers/video/fbdev/core/fbmem.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's repository.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/05f6e183879d9785a3cdf2f08a498bc31b7a20aa
https://git.kernel.org/stable/c/1a10d91766eb6ddfd5414e4785611e33a4fe0f9b
https://git.kernel.org/stable/c/3ca78032a388a0795201792b36e6fc9b6e6e8eed
https://git.kernel.org/stable/c/8a3a2887794b2c8e78b3e5d6e3de724527c9f41b
https://git.kernel.org/stable/c/b3071bb463ea1e6c686d0dc9638fc940f2f5cf17
https://git.kernel.org/stable/c/ee20216f12d9482cd70e44dae5e7fabb38367c71
https://git.kernel.org/stable/c/fab201d72fde38d081e2c5d4ad25595c535b7b22
https://git.kernel.org/stable/c/ff0e037241173b574b385bff53d67567b9816db5

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.