CVE-2025-38312

In the Linux kernel, the following vulnerability has been resolved:

fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()

In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000, cvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's then passed to fb_cvt_hperiod(), where it's used as a divider -- division by 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to avoid such overflow...

Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool.

A division-by-zero bug was fixed in the fb_cvt_hperiod() function of the framebuffer subsystem. Specifically, a malformed or extremely large refresh rate value could cause integer overflow in cvt.f_refresh, resulting in zero being passed to a division operation. This could lead to a kernel oops. The impact on availability is high, since it may cause the kernel to crash if invalid input is not filtered. The bug was found using the Svace static analyzer. Normally, framebuffer settings are modifiable only by root or kernel modules, so for the CVSS the required privileges High.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.