CVE-2025-38198

Vulnerability

CVE-2025-38198 is an out-of-bounds array access in the Linux kernel's framebuffer console (fbcon) subsystem. The root cause lies in fbcon_info_from_console(), which uses con2fb_map[console] as an index into the fbcon_registered_fb[] array. When con2fb_map[console] contains -1 (meaning the console is not bound to any framebuffer), the resulting index is -1, causing an array-index-out-of-bounds error [1][2]. This flaw was introduced because the function does not validate the mapping index before dereferencing the array.

Exploitation

An attacker can trigger this bug by writing to the store_modes sysfs node for a framebuffer device (/sys/class/graphics/fb*/modes). This operation calls fb_new_modelist() → fbcon_new_modelist() → fbcon_info_from_console() with a console index that maps to -1 [1]. The attacker needs local access to the system and the ability to write to sysfs (typically root or video group permissions). No special hardware or physical access is required.

Impact

Successful exploitation causes an UBSAN-detected out-of-bounds read/write, which can corrupt kernel memory. This may lead to a system crash (denial of service) or, in principle, be leveraged for privilege escalation if the out-of-bounds access is controlled to overwrite sensitive kernel structures [1]. The vulnerability is rated High with CVSS v3 7.8 due to its potential for local privilege escalation.

Mitigation

The fix is merged into the Linux kernel stable tree [2][3]. The patch modifies fbcon_info_from_console() to return NULL when con2fb_map[console] is -1, which forces callers to handle the error gracefully. Administrators should apply the latest kernel updates from their distribution or compile a patched kernel. No workaround is available other than restricting access to the sysfs interface.