CVE-2025-38702

What it actually does

Missing boundary check in do_register_framebuffer allows out-of-bounds write to registered_fb[FB_MAX] when NULL gaps from unregistration combine with num_registered_fb < FB_MAX, enabling memory corruption.

Why it matters to the business

Local attackers on affected Linux systems can achieve privilege escalation or full host compromise, especially in containerized or graphical environments; high prevalence in kernel deployments increases exposure across servers and endpoints, with threat actor interest noted in related container privilege escalations.

How an attack unfolds

An attacker with local user access crafts conditions to populate registered_fb with NULL gaps, then triggers repeated framebuffer registrations; the flawed loop writes past array bounds, corrupting kernel memory for code execution. Observed in campaigns by groups such as VMSCAPE targeting container-optimized OS alongside similar kernel privilege-escalation flaws.

How to fix it

Apply the upstream fix commit 5c3f5a25c62230b7965804ce7a2e9305c3ca3961 to the Linux kernel; for grafana-fips-11.5 (MinimOS) update to 11.5.7-r2. Rebuild and reboot systems using the patched kernel.

How to confirm the fix worked

Confirm kernel source contains the boundary check added to do_register_framebuffer; verify running kernel commit or package version matches the fixed revision; test framebuffer registration paths do not exceed FB_MAX.

Typical attack path

1. Obtain local shell or container access on target Linux host
2. Trigger unregistration of framebuffers to create NULL gaps in registered_fb
3. Perform repeated registrations to exceed array bounds
4. Exploit resulting memory corruption for privilege escalation or persistence

How to detect it

Search kernel logs and audit trails for repeated fbdev registration or unregistration events around crashes; correlate with container runtime activity on systems targeted by VMSCAPE or similar container-focused campaigns; inspect for anomalous memory corruption indicators in dmesg.

What your security team should do

• Immediately update all Linux kernels to the fixed commit or patched package version
• Prioritize systems exposed to untrusted local users or containers
• Monitor for related threat actor activity such as VMSCAPE in container environments
• Review and restrict framebuffer device access where feasible