CVE-2025-38685

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fbdev: Fix vmalloc out-of-bounds write in fast_imageblit<br /> <br /> This issue triggers when a userspace program does an ioctl<br /> FBIOPUT_CON2FBMAP by passing console number and frame buffer number.<br /> Ideally this maps console to frame buffer and updates the screen if<br /> console is visible.<br /> <br /> As part of mapping it has to do resize of console according to frame<br /> buffer info. if this resize fails and returns from vc_do_resize() and<br /> continues further. At this point console and new frame buffer are mapped<br /> and sets display vars. Despite failure still it continue to proceed<br /> updating the screen at later stages where vc_data is related to previous<br /> frame buffer and frame buffer info and display vars are mapped to new<br /> frame buffer and eventully leading to out-of-bounds write in<br /> fast_imageblit(). This bheviour is excepted only when fg_console is<br /> equal to requested console which is a visible console and updates screen<br /> with invalid struct references in fbcon_putcs().