CVE-2025-38198

What it actually does

Out-of-bounds array access in fbcon_info_from_console when con2fb_map[console] is -1 for an unregistered console, triggered via store_modes sysfs write leading to fbcon_new_modelist.

Why it matters to the business

Local users on affected Linux systems can trigger kernel instability or crashes, potentially leading to denial of service or escalation to higher privileges on systems relying on framebuffer consoles.

How an attack unfolds

An attacker with local access writes to the store_modes sysfs attribute on a system where a console remains unregistered in fbcon_registered_fb, causing the negative index dereference in fbcon_info_from_console and subsequent undefined behavior or panic.

How to fix it

Update Linux kernel to commit b3237d451bf3a4490cb1a76f3b7c91d9888f1c4b or later; for smarter-device-manager-fips upgrade to version 1.20.11-r17.

How to confirm the fix worked

Verify kernel source contains the fix preventing -1 index usage in fbcon_info_from_console and test store_modes writes do not produce UBSAN reports.

Typical attack path

1. Obtain local shell access on target Linux system
2. Locate and write to /sys/class/graphics/fb*/device/store_modes
3. Trigger fb_new_modelist path with unregistered console state
4. Cause array-index-out-of-bounds in fbcon.c resulting in crash or memory corruption

How to detect it

Search kernel logs and dmesg for UBSAN array-index-out-of-bounds messages mentioning fbcon_info_from_console or fbcon_new_modelist; inspect sysfs write attempts to store_modes on framebuffer devices.

• UBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28
• fbcon_info_from_console+0x192/0x1a0
• fbcon_new_modelist+0xbf/0x2d0
• store_modes+0x1c9/0x3e0

What your security team should do

• Prioritize kernel upgrade on all systems exposing framebuffer sysfs interfaces
• Monitor for UBSAN array-index-out-of-bounds reports referencing fbcon.c
• Restrict unprivileged access to graphics sysfs nodes where feasible