CVE-2025-38312

What it actually does

Division by zero in fb_cvt_hperiod() triggered when fb_find_mode_cvt() receives a refresh value of 0x80000000 causing integer overflow to zero in cvt.f_refresh, resulting in kernel oops.

Why it matters to the business

Local users on affected Linux kernel versions can trigger system crashes or denial of service; high downstream usage of linux-lts increases exposure across server and embedded deployments, with urgency to meet fixed versions before any potential escalation.

How an attack unfolds

An attacker with local access crafts a video mode structure with refresh set to 0x80000000, invokes fb_find_mode_cvt() which overflows to produce a zero f_refresh value, then passes it to fb_cvt_hperiod() causing the kernel to divide by zero and panic; listed threat actors have targeted similar Linux kernel issues for privilege escalation but none confirmed for this CVE.

How to fix it

Upgrade linux-lts (Alpaquita:stream) to 6.6.58-r0 or 6.12.41-r0; apply upstream commit 9027ce4c037b566b658b8939a76326b7125e3627 in the stable Linux kernel tree; reboot after kernel package update.

How to confirm the fix worked

Verify running kernel version against fixed releases; attempt to reproduce the zero-refresh overflow path in a test environment and confirm absence of oops; review kernel logs for related division-by-zero panics post-upgrade.

Typical attack path

1. Obtain local user access on target system
2. Prepare fb_var_screeninfo or mode structure with refresh=0x80000000
3. Call fb_find_mode_cvt() or equivalent framebuffer mode selection API
4. Trigger division by zero in fb_cvt_hperiod() leading to kernel oops

How to detect it

Search kernel logs and dmesg for division-by-zero oops or panic messages referencing fb_cvt_hperiod or fb_find_mode_cvt; inspect audit logs for unusual calls to framebuffer mode-setting syscalls by non-root processes; correlate with any listed threat actor tooling that targets kernel graphics paths.

• division by zero in fb_cvt_hperiod
• fb_find_mode_cvt overflow refresh
• kernel panic: divide error
• Unable to handle kernel NULL pointer dereference in fb_cvt

What your security team should do

• Prioritize kernel upgrades on all linux-lts deployments within the next maintenance window
• Restrict untrusted local user access to framebuffer or graphics mode configuration APIs until patched
• Monitor EPSS trend (+15%) and re-evaluate if exploit code appears
• Include this fix in automated kernel update pipelines for downstream dependents