CVE-2025-38427

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> video: screen_info: Relocate framebuffers behind PCI bridges<br /> <br /> Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes<br /> invalid access to I/O memory.<br /> <br /> Resources behind a PCI host bridge can be relocated by a certain offset<br /> in the kernel&amp;#39;s CPU address range used for I/O. The framebuffer memory<br /> range stored in screen_info refers to the CPU addresses as seen during<br /> boot (where the offset is 0). During boot up, firmware may assign a<br /> different memory offset to the PCI host bridge and thereby relocating<br /> the framebuffer address of the PCI graphics device as seen by the kernel.<br /> The information in screen_info must be updated as well.<br /> <br /> The helper pcibios_bus_to_resource() performs the relocation of the<br /> screen_info&amp;#39;s framebuffer resource (given in PCI bus addresses). The<br /> result matches the I/O-memory resource of the PCI graphics device (given<br /> in CPU addresses). As before, we store away the information necessary to<br /> later update the information in screen_info itself.<br /> <br /> Commit 78aa89d1dfba ("firmware/sysfb: Update screen_info for relocated<br /> EFI framebuffers") added the code for updating screen_info. It is based<br /> on similar functionality that pre-existed in efifb. Efifb uses a pointer<br /> to the PCI resource, while the newer code does a memcpy of the region.<br /> Hence efifb sees any updates to the PCI resource and avoids the issue.<br /> <br /> v3:<br /> - Only use struct pci_bus_region for PCI bus addresses (Bjorn)<br /> - Clarify address semantics in commit messages and comments (Bjorn)<br /> v2:<br /> - Fixed tags (Takashi, Ivan)<br /> - Updated information on efifb