high 7.8

CVE-2025-38685 json

fbdev: Fix vmalloc out-of-bounds write in fast_imageblit

published 2025-09-04 14 mo ago modified 2026-10-19 20 d ago also EUVD-2025-26784

cvss: 7.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible.

As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs().

Patch / fix

fixed in 2 distros 5 links 7

Linux Linux 5.15.190, 6.1.149, 6.6.103, 6.12.43, 6.15.11, 6.16.2, 6.17
Siemens SIMATIC CN 4100 V5.0

debian ubuntu suse opensuse azure linux

linux Debian 12 6.1.153-1
linux Debian 13 6.12.43-1
linux Debian 14 6.16.3-1

debian advisories DEBIAN-CVE-2025-38685

linux Ubuntu 22.04 LTS 5.15.0-163.173
linux Ubuntu 24.04 LTS 6.8.0-100.100
linux-aws Ubuntu 22.04 LTS 5.15.0-1097.104
linux-aws Ubuntu 24.04 LTS 6.8.0-1046.49
linux-gcp Ubuntu 22.04 LTS 5.15.0-1097.106
linux-gcp Ubuntu 24.04 LTS 6.8.0-1047.50
linux-gke Ubuntu 22.04 LTS 5.15.0-1093.99
linux-gke Ubuntu 24.04 LTS 6.8.0-1043.48

ubuntu advisories UBUNTU-CVE-2025-38685

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-rt Linux Micro 6.2 6.12.0-160000.6.1
kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.6.1
kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1.160000.2.4
kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
kernel-obs-qa SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.6.1
kernel-kvmsmall SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.6.1

suse advisories SUSE-SU-2025:4315-1 SUSE-SU-2025:21074-1 SUSE-SU-2025:21139-1 SUSE-SU-2026:20560-1 SUSE-SU-2025:21179-1 SUSE-SU-2025:4141-1

kernel-rt openSUSE Leap 16.0 6.12.0-160000.6.1
dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-64kb openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-syms openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-source openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-default openSUSE Leap 16.0 6.12.0-160000.6.1
kernel-kvmsmall openSUSE Leap 16.0 6.12.0-160000.6.1

opensuse advisories openSUSE-SU-2025:20081-1

kernel Azure Linux 3.0 6.6.104.2-1
kernel CBL-Mariner 2.0 5.15.200.1-1

azure linux advisories AZL-66794 AZL-73836

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-38685 updated 2026-11-05 cvss 6.1

kernel: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-162-05 updated 2026-05-14 cvss 7.8

Siemens SIMATIC S7-1500 CPU family

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.5
affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-26-134-10 updated 2026-05-14 cvss 7.8

Siemens SIMATIC

Siemens SIMATIC CN 4100 < 5.0
affected: fixed in V5.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux Linux
Siemens SIMATIC CN 4100
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness

CWE-787 Out-of-bounds Write

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2025-38685
NVD CVE-2025-38685

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary