CVE-2025-38685

What it actually does

Out-of-bounds write in fast_imageblit() triggered by mismatched vc_data (from previous framebuffer) and display vars (from new framebuffer) after a failed vc_do_resize() in the FBIOPUT_CON2FBMAP ioctl path; occurs only on visible consoles (fg_console match).

Why it matters to the business

Local memory corruption on Linux systems using framebuffer consoles can lead to kernel crashes, denial of service, or privilege escalation; high prevalence in container and server environments increases exposure for organizations running affected kernels.

How an attack unfolds

An attacker invokes the FBIOPUT_CON2FBMAP ioctl from userspace with chosen console and framebuffer numbers; the resize operation fails yet mapping proceeds, leaving invalid struct references; subsequent screen updates on the visible console invoke fbcon_putcs() and fast_imageblit() with mismatched pointers, resulting in an out-of-bounds write. Threat actors listed in active campaigns may chain this with other kernel flaws for container escape or spyware deployment.

How to fix it

Upgrade the Linux kernel to the commit 078e62bffca4b7e72e8f3550eb063ab981c36c7a or any later stable release containing the fix; rebuild and reboot systems with the patched kernel; disable framebuffer console mapping where operationally feasible as a temporary mitigation.

How to confirm the fix worked

Verify the running kernel contains commit 078e62bffca4b7e72e8f3550eb063ab981c36c7a via git log or uname; attempt the FBIOPUT_CON2FBMAP ioctl in a test environment and confirm absence of out-of-bounds write or kernel oops; review dmesg for fbcon-related warnings post-upgrade.

Typical attack path

1. Invoke FBIOPUT_CON2FBMAP ioctl supplying console and framebuffer identifiers
2. Force vc_do_resize() failure while allowing mapping to continue
3. Trigger fbcon_putcs() on the visible console with stale vc_data
4. Execute fast_imageblit() using inconsistent display variables to perform out-of-bounds write

How to detect it

Search kernel logs and audit trails for FBIOPUT_CON2FBMAP ioctl invocations followed by fbcon or fast_imageblit faults; inspect dmesg and journalctl for vmalloc out-of-bounds write messages or vc_do_resize failures on visible consoles; correlate with process execution of console-mapping utilities.

• FBIOPUT_CON2FBMAP
• fast_imageblit
• vc_do_resize
• fbcon_putcs
• vmalloc out-of-bounds write

What your security team should do

• Prioritize kernel updates on all systems exposing framebuffer consoles, especially those in container-optimized OS deployments
• Harden userspace access to console ioctls through seccomp or LSM policies
• Monitor EPSS trend and threat actor activity for escalation in exploitation attempts
• Test patched kernels in staging before broad rollout given the 418-day publication window