---
id: CVE-2025-38427
title: 'video: screen_info: Relocate framebuffers behind PCI bridges'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  video: screen_info: Relocate framebuffers behind PCI bridges

  Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes
  invalid access to I/O memory.

  Res…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a168da3182f8727b338509cb413147aa29012d6f <
    cc3cc41ed67054a03134bea42408c720eec0fa04
  - >-
    Linux >= 78aa89d1dfba1e3cf4a2e053afa3b4c4ec622371 <
    5c70e3ad85d2890d8af375333699429de26327f2
  - >-
    Linux >= 78aa89d1dfba1e3cf4a2e053afa3b4c4ec622371 <
    aeda386d86d79269a08f470dbdc53d13a91e51fa
  - >-
    Linux >= 78aa89d1dfba1e3cf4a2e053afa3b4c4ec622371 <
    2f29b5c231011b94007d2c8a6d793992f2275db1
  - Linux >= 6.6.45 < 6.6.95
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:56:25.474852Z'
published: '2025-07-25'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:02:37.469Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38427'
references:
  - url: 'https://git.kernel.org/stable/c/cc3cc41ed67054a03134bea42408c720eec0fa04'
  - url: 'https://git.kernel.org/stable/c/5c70e3ad85d2890d8af375333699429de26327f2'
  - url: 'https://git.kernel.org/stable/c/aeda386d86d79269a08f470dbdc53d13a91e51fa'
  - url: 'https://git.kernel.org/stable/c/2f29b5c231011b94007d2c8a6d793992f2275db1'
tags:
  - cve.org
epss: 0.00189
epssPercentile: 0.08528
ingestedAt: '2026-11-05T22:38:31.986Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

video: screen_info: Relocate framebuffers behind PCI bridges

Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes
invalid access to I/O memory.

Resources behind a PCI host bridge can be relocated by a certain offset
in the kernel's CPU address range used for I/O. The framebuffer memory
range stored in screen_info refers to the CPU addresses as seen during
boot (where the offset is 0). During boot up, firmware may assign a
different memory offset to the PCI host bridge and thereby relocating
the framebuffer address of the PCI graphics device as seen by the kernel.
The information in screen_info must be updated as well.

The helper pcibios_bus_to_resource() performs the relocation of the
screen_info's framebuffer resource (given in PCI bus addresses). The
result matches the I/O-memory resource of the PCI graphics device (given
in CPU addresses). As before, we store away the information necessary to
later update the information in screen_info itself.

Commit 78aa89d1dfba ("firmware/sysfb: Update screen_info for relocated
EFI framebuffers") added the code for updating screen_info. It is based
on similar functionality that pre-existed in efifb. Efifb uses a pointer
to the PCI resource, while the newer code does a memcpy of the region.
Hence efifb sees any updates to the PCI resource and avoids the issue.

v3:
- Only use struct pci_bus_region for PCI bus addresses (Bjorn)
- Clarify address semantics in commit messages and comments (Bjorn)
v2:
- Fixed tags (Takashi, Ivan)
- Updated information on efifb

## Affected

- `Linux >= a168da3182f8727b338509cb413147aa29012d6f < cc3cc41ed67054a03134bea42408c720eec0fa04`
- `Linux >= 78aa89d1dfba1e3cf4a2e053afa3b4c4ec622371 < 5c70e3ad85d2890d8af375333699429de26327f2`
- `Linux >= 78aa89d1dfba1e3cf4a2e053afa3b4c4ec622371 < aeda386d86d79269a08f470dbdc53d13a91e51fa`
- `Linux >= 78aa89d1dfba1e3cf4a2e053afa3b4c4ec622371 < 2f29b5c231011b94007d2c8a6d793992f2275db1`
- `Linux >= 6.6.45 < 6.6.95`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.