{"id":"CVE-2025-38312","title":"fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()\n\nIn fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000,\ncvt.f_refresh will become 0 when…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 9027ce4c037b566b658b8939a76326b7125e3627","Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 610f247f2772e4f92b63442125a1b7ade79898d8","Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 2d63433e8eaa3c91b2948190e395bc67009db0d9","Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 54947530663edcbaaee1314c01fdd8c72861b124","Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < ab91647acdf43b984824776559a452212eaeb21a","Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < b235393b9f43ff86a38ca2bde6372312ea215dc5","Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 53784073cbad18f75583fd3da9ffdfc4d1f05405","Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 3f6dae09fc8c306eb70fdfef70726e1f154e173a","Linux 2.6.14"],"published":"2025-07-10","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:07:03.801Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38312","references":[{"url":"https://git.kernel.org/stable/c/9027ce4c037b566b658b8939a76326b7125e3627"},{"url":"https://git.kernel.org/stable/c/610f247f2772e4f92b63442125a1b7ade79898d8"},{"url":"https://git.kernel.org/stable/c/2d63433e8eaa3c91b2948190e395bc67009db0d9"},{"url":"https://git.kernel.org/stable/c/54947530663edcbaaee1314c01fdd8c72861b124"},{"url":"https://git.kernel.org/stable/c/ab91647acdf43b984824776559a452212eaeb21a"},{"url":"https://git.kernel.org/stable/c/b235393b9f43ff86a38ca2bde6372312ea215dc5"},{"url":"https://git.kernel.org/stable/c/53784073cbad18f75583fd3da9ffdfc4d1f05405"},{"url":"https://git.kernel.org/stable/c/3f6dae09fc8c306eb70fdfef70726e1f154e173a"}],"tags":["cve.org"],"epss":0.00183,"epssPercentile":0.07804,"ingestedAt":"2026-10-15T05:52:46.090Z","slug":"CVE-2025-38312","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()\n\nIn fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000,\ncvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's\nthen passed to fb_cvt_hperiod(), where it's used as a divider -- division\nby 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to\navoid such overflow...\n\nFound by Linux Verification Center (linuxtesting.org) with the Svace static\nanalysis tool.\n\n## Affected\n\n- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 9027ce4c037b566b658b8939a76326b7125e3627`\n- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 610f247f2772e4f92b63442125a1b7ade79898d8`\n- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 2d63433e8eaa3c91b2948190e395bc67009db0d9`\n- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 54947530663edcbaaee1314c01fdd8c72861b124`\n- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < ab91647acdf43b984824776559a452212eaeb21a`\n- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < b235393b9f43ff86a38ca2bde6372312ea215dc5`\n- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 53784073cbad18f75583fd3da9ffdfc4d1f05405`\n- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 3f6dae09fc8c306eb70fdfef70726e1f154e173a`\n- `Linux 2.6.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}