---
id: CVE-2025-38312
title: 'fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()

  In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000,
  cvt.f_refresh will become 0 when…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a <
    9027ce4c037b566b658b8939a76326b7125e3627
  - >-
    Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a <
    610f247f2772e4f92b63442125a1b7ade79898d8
  - >-
    Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a <
    2d63433e8eaa3c91b2948190e395bc67009db0d9
  - >-
    Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a <
    54947530663edcbaaee1314c01fdd8c72861b124
  - >-
    Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a <
    ab91647acdf43b984824776559a452212eaeb21a
  - >-
    Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a <
    b235393b9f43ff86a38ca2bde6372312ea215dc5
  - >-
    Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a <
    53784073cbad18f75583fd3da9ffdfc4d1f05405
  - >-
    Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a <
    3f6dae09fc8c306eb70fdfef70726e1f154e173a
  - Linux 2.6.14
published: '2025-07-10'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:07:03.801Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38312'
references:
  - url: 'https://git.kernel.org/stable/c/9027ce4c037b566b658b8939a76326b7125e3627'
  - url: 'https://git.kernel.org/stable/c/610f247f2772e4f92b63442125a1b7ade79898d8'
  - url: 'https://git.kernel.org/stable/c/2d63433e8eaa3c91b2948190e395bc67009db0d9'
  - url: 'https://git.kernel.org/stable/c/54947530663edcbaaee1314c01fdd8c72861b124'
  - url: 'https://git.kernel.org/stable/c/ab91647acdf43b984824776559a452212eaeb21a'
  - url: 'https://git.kernel.org/stable/c/b235393b9f43ff86a38ca2bde6372312ea215dc5'
  - url: 'https://git.kernel.org/stable/c/53784073cbad18f75583fd3da9ffdfc4d1f05405'
  - url: 'https://git.kernel.org/stable/c/3f6dae09fc8c306eb70fdfef70726e1f154e173a'
tags:
  - cve.org
epss: 0.00183
epssPercentile: 0.07804
ingestedAt: '2026-10-15T05:52:46.090Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()

In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000,
cvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's
then passed to fb_cvt_hperiod(), where it's used as a divider -- division
by 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to
avoid such overflow...

Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.

## Affected

- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 9027ce4c037b566b658b8939a76326b7125e3627`
- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 610f247f2772e4f92b63442125a1b7ade79898d8`
- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 2d63433e8eaa3c91b2948190e395bc67009db0d9`
- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 54947530663edcbaaee1314c01fdd8c72861b124`
- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < ab91647acdf43b984824776559a452212eaeb21a`
- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < b235393b9f43ff86a38ca2bde6372312ea215dc5`
- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 53784073cbad18f75583fd3da9ffdfc4d1f05405`
- `Linux >= 96fe6a2109db29cd15b90a093c16e6cb4b19371a < 3f6dae09fc8c306eb70fdfef70726e1f154e173a`
- `Linux 2.6.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.