CVE-2025-38427 (GCVE-0-2025-38427)
Vulnerability from cvelistv5
Published
2025-07-25 14:16
Modified
2025-07-28 04:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
video: screen_info: Relocate framebuffers behind PCI bridges
Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes
invalid access to I/O memory.
Resources behind a PCI host bridge can be relocated by a certain offset
in the kernel's CPU address range used for I/O. The framebuffer memory
range stored in screen_info refers to the CPU addresses as seen during
boot (where the offset is 0). During boot up, firmware may assign a
different memory offset to the PCI host bridge and thereby relocating
the framebuffer address of the PCI graphics device as seen by the kernel.
The information in screen_info must be updated as well.
The helper pcibios_bus_to_resource() performs the relocation of the
screen_info's framebuffer resource (given in PCI bus addresses). The
result matches the I/O-memory resource of the PCI graphics device (given
in CPU addresses). As before, we store away the information necessary to
later update the information in screen_info itself.
Commit 78aa89d1dfba ("firmware/sysfb: Update screen_info for relocated
EFI framebuffers") added the code for updating screen_info. It is based
on similar functionality that pre-existed in efifb. Efifb uses a pointer
to the PCI resource, while the newer code does a memcpy of the region.
Hence efifb sees any updates to the PCI resource and avoids the issue.
v3:
- Only use struct pci_bus_region for PCI bus addresses (Bjorn)
- Clarify address semantics in commit messages and comments (Bjorn)
v2:
- Fixed tags (Takashi, Ivan)
- Updated information on efifb
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/screen_info_pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc3cc41ed67054a03134bea42408c720eec0fa04",
"status": "affected",
"version": "a168da3182f8727b338509cb413147aa29012d6f",
"versionType": "git"
},
{
"lessThan": "5c70e3ad85d2890d8af375333699429de26327f2",
"status": "affected",
"version": "78aa89d1dfba1e3cf4a2e053afa3b4c4ec622371",
"versionType": "git"
},
{
"lessThan": "aeda386d86d79269a08f470dbdc53d13a91e51fa",
"status": "affected",
"version": "78aa89d1dfba1e3cf4a2e053afa3b4c4ec622371",
"versionType": "git"
},
{
"lessThan": "2f29b5c231011b94007d2c8a6d793992f2275db1",
"status": "affected",
"version": "78aa89d1dfba1e3cf4a2e053afa3b4c4ec622371",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/screen_info_pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.95",
"versionStartIncluding": "6.6.45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.35",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.4",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: screen_info: Relocate framebuffers behind PCI bridges\n\nApply PCI host-bridge window offsets to screen_info framebuffers. Fixes\ninvalid access to I/O memory.\n\nResources behind a PCI host bridge can be relocated by a certain offset\nin the kernel\u0027s CPU address range used for I/O. The framebuffer memory\nrange stored in screen_info refers to the CPU addresses as seen during\nboot (where the offset is 0). During boot up, firmware may assign a\ndifferent memory offset to the PCI host bridge and thereby relocating\nthe framebuffer address of the PCI graphics device as seen by the kernel.\nThe information in screen_info must be updated as well.\n\nThe helper pcibios_bus_to_resource() performs the relocation of the\nscreen_info\u0027s framebuffer resource (given in PCI bus addresses). The\nresult matches the I/O-memory resource of the PCI graphics device (given\nin CPU addresses). As before, we store away the information necessary to\nlater update the information in screen_info itself.\n\nCommit 78aa89d1dfba (\"firmware/sysfb: Update screen_info for relocated\nEFI framebuffers\") added the code for updating screen_info. It is based\non similar functionality that pre-existed in efifb. Efifb uses a pointer\nto the PCI resource, while the newer code does a memcpy of the region.\nHence efifb sees any updates to the PCI resource and avoids the issue.\n\nv3:\n- Only use struct pci_bus_region for PCI bus addresses (Bjorn)\n- Clarify address semantics in commit messages and comments (Bjorn)\nv2:\n- Fixed tags (Takashi, Ivan)\n- Updated information on efifb"
}
],
"providerMetadata": {
"dateUpdated": "2025-07-28T04:21:52.177Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cc3cc41ed67054a03134bea42408c720eec0fa04"
},
{
"url": "https://git.kernel.org/stable/c/5c70e3ad85d2890d8af375333699429de26327f2"
},
{
"url": "https://git.kernel.org/stable/c/aeda386d86d79269a08f470dbdc53d13a91e51fa"
},
{
"url": "https://git.kernel.org/stable/c/2f29b5c231011b94007d2c8a6d793992f2275db1"
}
],
"title": "video: screen_info: Relocate framebuffers behind PCI bridges",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38427",
"datePublished": "2025-07-25T14:16:47.305Z",
"dateReserved": "2025-04-16T04:51:24.015Z",
"dateUpdated": "2025-07-28T04:21:52.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-38427\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T15:15:27.623\",\"lastModified\":\"2025-07-25T15:29:19.837\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvideo: screen_info: Relocate framebuffers behind PCI bridges\\n\\nApply PCI host-bridge window offsets to screen_info framebuffers. Fixes\\ninvalid access to I/O memory.\\n\\nResources behind a PCI host bridge can be relocated by a certain offset\\nin the kernel\u0027s CPU address range used for I/O. The framebuffer memory\\nrange stored in screen_info refers to the CPU addresses as seen during\\nboot (where the offset is 0). During boot up, firmware may assign a\\ndifferent memory offset to the PCI host bridge and thereby relocating\\nthe framebuffer address of the PCI graphics device as seen by the kernel.\\nThe information in screen_info must be updated as well.\\n\\nThe helper pcibios_bus_to_resource() performs the relocation of the\\nscreen_info\u0027s framebuffer resource (given in PCI bus addresses). The\\nresult matches the I/O-memory resource of the PCI graphics device (given\\nin CPU addresses). As before, we store away the information necessary to\\nlater update the information in screen_info itself.\\n\\nCommit 78aa89d1dfba (\\\"firmware/sysfb: Update screen_info for relocated\\nEFI framebuffers\\\") added the code for updating screen_info. It is based\\non similar functionality that pre-existed in efifb. Efifb uses a pointer\\nto the PCI resource, while the newer code does a memcpy of the region.\\nHence efifb sees any updates to the PCI resource and avoids the issue.\\n\\nv3:\\n- Only use struct pci_bus_region for PCI bus addresses (Bjorn)\\n- Clarify address semantics in commit messages and comments (Bjorn)\\nv2:\\n- Fixed tags (Takashi, Ivan)\\n- Updated information on efifb\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2f29b5c231011b94007d2c8a6d793992f2275db1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5c70e3ad85d2890d8af375333699429de26327f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aeda386d86d79269a08f470dbdc53d13a91e51fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cc3cc41ed67054a03134bea42408c720eec0fa04\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…