CVE-2025-38198 Overview
CVE-2025-38198 is an out-of-bounds array access vulnerability in the Linux kernel framebuffer console (fbcon) subsystem. The flaw resides in fbcon_info_from_console() within drivers/video/fbdev/core/fbcon.c. When a userspace process writes to the store_modes sysfs node, the function dereferences fbcon_registered_fb[con2fb_map[console]] without validating that con2fb_map[console] is non-negative. An index value of -1 triggers an out-of-bounds read on the fb_info *[32] array, as flagged by the Undefined Behavior Sanitizer (UBSAN).
The issue is categorized under [CWE-129] (Improper Validation of Array Index) and affects local, authenticated users with access to framebuffer sysfs attributes.
Critical Impact
A local attacker with write access to /sys/class/graphics/*/store_modes can trigger kernel memory corruption, leading to potential privilege escalation or denial of service.
Affected Products
- Linux Kernel (multiple stable branches prior to fix commits)
- Debian Linux 11.0
- Siemens industrial products embedding affected kernel versions
Discovery Timeline
- 2025-07-04 - CVE-2025-38198 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-38198
Vulnerability Analysis
The Linux framebuffer console maintains two static arrays: fbcon_registered_fb[FB_MAX], which tracks registered framebuffer devices, and con2fb_map[MAX_NR_CONSOLES], which maps virtual consoles to framebuffer indexes. The helper function fbcon_info_from_console() returns fbcon_registered_fb[con2fb_map[console]] without verifying the map entry.
When a console is unregistered, its entry in con2fb_map is set to -1. Callers that later invoke fbcon_info_from_console() for that console index cause a signed-index out-of-bounds read against the fb_info *[32] array. The kernel then returns an attacker-influenced pointer that callers compare against valid info pointers, bypassing intended error handling.
Root Cause
The root cause is missing validation of con2fb_map[console] before it is used as an array index. The sentinel value -1 used to mark unregistered consoles was never checked, allowing negative-index dereference. The fix returns NULL when the map entry is negative, allowing existing null-pointer comparisons in callers to trigger correct error paths.
Attack Vector
Exploitation requires local access with permissions to write to framebuffer sysfs attributes such as store_modes. The attacker writes crafted mode data, forcing store_modes → fb_new_modelist → fbcon_new_modelist → fbcon_info_from_console on a console whose con2fb_map entry is -1. The resulting out-of-bounds read may leak kernel pointers or corrupt subsequent control flow, depending on adjacent memory contents and kernel configuration.
No public proof-of-concept exploit or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-38198
Indicators of Compromise
- UBSAN kernel log entries containing array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28 and index -1 is out of range for type 'fb_info *[32]'.
- Kernel stack traces referencing fbcon_info_from_console, fbcon_new_modelist, fb_new_modelist, and store_modes in close sequence.
- Unexpected writes to /sys/class/graphics/fb*/modes or store_modes sysfs nodes by non-graphics processes.
Detection Strategies
- Enable CONFIG_UBSAN on test and staging kernels to surface array-index violations during pre-production validation.
- Audit auditd rules for PATH events targeting /sys/class/graphics/ sysfs entries and correlate with the invoking user and process.
- Monitor dmesg and journalctl -k output for UBSAN warnings referencing fbcon.c.
Monitoring Recommendations
- Ship kernel ring buffer output to a centralized logging platform and alert on UBSAN and KASAN reports.
- Baseline expected writers to framebuffer sysfs paths and flag deviations, especially from unprivileged users.
- Track kernel version inventory to identify hosts still running unpatched stable branches referenced in the fix commits.
How to Mitigate CVE-2025-38198
Immediate Actions Required
- Apply the vendor kernel update containing the upstream fix that returns NULL from fbcon_info_from_console() when con2fb_map[console] < 0.
- Restrict local access on multi-user systems and remove shell access for accounts that do not require it.
- Verify sysfs permissions on /sys/class/graphics/fb*/ to ensure only privileged services can write mode attributes.
Patch Information
The fix is available in upstream Linux stable trees. See the mainline and stable backport commits: 519ba757, 54b28f7c, b3237d45, cedc1b63, and f28f1f57. Distribution updates are documented in the Debian LTS Announcement and the Siemens Security Advisory SSA-082556.
Workarounds
- On systems where framebuffer console is not required, blacklist fbcon and related framebuffer drivers via modprobe configuration.
- Tighten discretionary access controls on /sys/class/graphics/ to prevent non-root writes to store_modes.
- Apply mandatory access control policies (SELinux, AppArmor) that deny sysfs writes to framebuffer attributes for untrusted users.
# Example: restrict framebuffer sysfs writes and blacklist fbcon where unused
echo 'blacklist fbcon' | sudo tee /etc/modprobe.d/blacklist-fbcon.conf
sudo chmod 600 /sys/class/graphics/fb0/modes 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
