01 Record

CVE-2025-38702

fbdev: fix potential buffer overflow in do_register_framebuffer()

UnratedPUBLISHEDCNA: Linux

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

fbdev: fix potential buffer overflow in do_register_framebuffer()

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.19% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 8.6% of scored records. A rank, not a probability.
NVD base score: 7.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-10-19.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-09-04 15:32Z1 YR AGO

Last updated

2026-10-15 01:07Z14 DAYS AGO

Reserved

2025-04-16

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-787Out-of-bounds WriteBase

Data version

5.2

Document digest

f27ea236468c58fd9991f4645ba5a4aa78ba23e2879cf35d2ae50c616784edbd

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 5c3f5a25c62230b7965804ce7a2e9305c3ca3961, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < cbe740de32bb0fb7a5213731ff5f26ea6718fca3, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 806f85bdd3a60187c21437fc51baace11f659f35, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 2828a433c7d7a05b6f27c8148502095101dd0b09, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 248b2aab9b2af5ecf89d9d7955a2ff20c4b4a399, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 523b84dc7ccea9c4d79126d6ed1cf9033cf83b05, 2.6.12—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/5c3f5a25c62230b7965804ce7a2e9305c3ca3961
git.kernel.orghttps://git.kernel.org/stable/c/cbe740de32bb0fb7a5213731ff5f26ea6718fca3
git.kernel.orghttps://git.kernel.org/stable/c/806f85bdd3a60187c21437fc51baace11f659f35
git.kernel.orghttps://git.kernel.org/stable/c/2828a433c7d7a05b6f27c8148502095101dd0b09
git.kernel.orghttps://git.kernel.org/stable/c/248b2aab9b2af5ecf89d9d7955a2ff20c4b4a399
git.kernel.orghttps://git.kernel.org/stable/c/523b84dc7ccea9c4d79126d6ed1cf9033cf83b05
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-032379.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.153-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.43-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.16.3-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.