CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
In the Linux kernel, the following vulnerability has been resolved:
fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
This issue triggers when a userspace program does an ioctl
FBIOPUT_CON2FBMAP by passing console number and frame buffer number.
Ideally this maps console to frame buffer and updates the screen if
console is visible.
As part of mapping it has to do resize of console according to frame
buffer info. if this resize fails and returns from vc_do_resize() and
continues further. At this point console and new frame buffer are mapped
and sets display vars. Despite failure still it continue to proceed
updating the screen at later stages where vc_data is related to previous
frame buffer and frame buffer info and display vars are mapped to new
frame buffer and eventully leading to out-of-bounds write in
fast_imageblit(). This bheviour is excepted only when fg_console is
equal to requested console which is a visible console and updates screen
with invalid struct references in fbcon_putcs().
Security readout for executives and security teams
Plain-English summary
A low-privileged local user could cause the Linux kernel to write outside an allocated memory area during a framebuffer-console remap. Successful exploitation could crash or potentially compromise the host. This is not described as a remote vulnerability.
Executive priority
Prioritize affected multi-user, workstation, appliance, and console-enabled systems where untrusted users can obtain local access. Patch through supported vendor channels during the next urgent maintenance window. Internet exposure alone does not establish reachability, but local footholds could turn this kernel memory-corruption flaw into a high-impact escalation opportunity.
Technical view
FBIOPUT_CON2FBMAP can continue after vc_do_resize() fails, leaving console data associated with the previous framebuffer while display variables reference the new framebuffer. Updating the visible console through fbcon_putcs() can consequently cause a vmalloc out-of-bounds write in fast_imageblit().
Likely exposure
Exposure is most likely on affected Linux builds using fbdev or framebuffer-console functionality and permitting low-privileged local users to reach the relevant interface. The supplied version list does not provide reliable branch boundaries, so package status must be confirmed through kernel, distribution, or device-vendor guidance.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. The requested console must be visible, and console resizing must fail. The source bundle marks this CVE as absent from KEV, and no supplied source reports active exploitation or a public exploit.
Researcher notes
The important state transition is continued processing after vc_do_resize() fails. Exploitability depends on the visible-console condition and mismatched old console data versus new framebuffer state. Treat the cited commit identifiers as branch-specific fixes, not universal version thresholds. The supplied evidence does not establish practical code execution or observed exploitation.
Mitigation direction
Install a vendor-supported kernel containing the applicable stable fix for CVE-2025-38685.
Use distribution or device-vendor advisories to identify the fixed release for each deployed kernel line.
Until patched, restrict untrusted local access and framebuffer device access where operationally safe.
Consult vendor guidance before disabling fbdev or fbcon because doing so may disrupt local console operations.
Validation and detection
Record active kernel and package versions, then compare them with vendor advisories for CVE-2025-38685.
Verify the installed kernel includes the applicable stable-branch fix referenced by the kernel sources.
Identify systems exposing fbdev or framebuffer-console functionality to low-privileged local users.
Reboot after upgrading and confirm the intended fixed kernel is active.
Review kernel logs for framebuffer faults or memory-corruption crashes; their absence does not prove safety.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-38685 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
2ADP providers
11Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.