CVE-2025-38214

A flaw was found in the Linux kernel. A local user could trigger a null-pointer dereference in the fb_videomode_to_var function within the fbdev subsystem. This occurs when fb_set_var fails to allocate memory for fb_videomode but does not properly restore the old fb_info->var value, leading to a system crash and resulting in a Denial of Service (DoS).

A NULL pointer dereference flaw may occur if fb_add_videomode() in fb_set_var() fails to allocate memory. This flaw could allow a local attacker to crash the system or leak internal kernel information.

Due to its DoS only nature of exploitation, is being treated as a Moderate Impact flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.