CVE-2025-38702

In the Linux kernel, the following vulnerability has been resolved:

fbdev: fix potential buffer overflow in do_register_framebuffer()

The current implementation may lead to buffer overflow when:

1. Unregistration creates NULL gaps in registered_fb[]
2. All array slots become occupied despite num_registered_fb < FB_MAX
3. The registration loop exceeds array bounds

Add boundary check to prevent registered_fb[FB_MAX] access.

A flaw was found in fbdev’s do_register_framebuffer() where gaps in registered_fb[] combined with a full array could let the loop step past FB_MAX, causing an out-of-bounds access and kernel memory corruption. This is locally reachable only through privileged framebuffer registration paths (e.g., driver probe/hotplug) and can lead to system instability or crash. Exploitable only on systems that actually use the legacy fbdev stack. Modern desktops/servers typically don’t expose or rely on /dev/fb*.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.