Skip to content
Not rated

CVE-2025-38312 fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()

Description

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000, cvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's then passed to fb_cvt_hperiod(), where it's used as a divider -- division by 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to avoid such overflow... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool.

Affected products and versions

Product Affected versions Fixed in
Linux 6.16 earliest → < 6.16 6.16
Linux 6.15 earliest → < 6.15.3 6.15.3
Linux 6.12 earliest → < 6.12.34 6.12.34
Linux 6.6 earliest → < 6.6.94 6.6.94
Linux 6.1 earliest → < 6.1.142 6.1.142
Linux 5.15 earliest → < 5.15.186 5.15.186
Linux 5.10 earliest → < 5.10.239 5.10.239
Linux 5.4 earliest → < 5.4.295 5.4.295
Linux 2.6.14 No fix stated
Show the 3 other branches
Product Affected versions Fixed in
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.5 → latest No fix stated
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 3.1.5 → latest No fix stated
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 3.1.5 → latest No fix stated
The 18286 CVEs of Linux →
Track this CVE