---
id: CVE-2025-38702
title: 'fbdev: fix potential buffer overflow in do_register_framebuffer()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fbdev: fix potential buffer overflow in do_register_framebuffer()

  The current implementation may lead to buffer overflow when:
  1.  Unregistration creates NULL gaps in …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    5c3f5a25c62230b7965804ce7a2e9305c3ca3961
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    cbe740de32bb0fb7a5213731ff5f26ea6718fca3
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    806f85bdd3a60187c21437fc51baace11f659f35
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    2828a433c7d7a05b6f27c8148502095101dd0b09
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    248b2aab9b2af5ecf89d9d7955a2ff20c4b4a399
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    523b84dc7ccea9c4d79126d6ed1cf9033cf83b05
  - Linux 2.6.12
published: '2025-09-04'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:07:40.934Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38702'
references:
  - url: 'https://git.kernel.org/stable/c/5c3f5a25c62230b7965804ce7a2e9305c3ca3961'
  - url: 'https://git.kernel.org/stable/c/cbe740de32bb0fb7a5213731ff5f26ea6718fca3'
  - url: 'https://git.kernel.org/stable/c/806f85bdd3a60187c21437fc51baace11f659f35'
  - url: 'https://git.kernel.org/stable/c/2828a433c7d7a05b6f27c8148502095101dd0b09'
  - url: 'https://git.kernel.org/stable/c/248b2aab9b2af5ecf89d9d7955a2ff20c4b4a399'
  - url: 'https://git.kernel.org/stable/c/523b84dc7ccea9c4d79126d6ed1cf9033cf83b05'
tags:
  - cve.org
epss: 0.00191
epssPercentile: 0.08648
ingestedAt: '2026-10-15T05:52:46.082Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fbdev: fix potential buffer overflow in do_register_framebuffer()

The current implementation may lead to buffer overflow when:
1.  Unregistration creates NULL gaps in registered_fb[]
2.  All array slots become occupied despite num_registered_fb < FB_MAX
3.  The registration loop exceeds array bounds

Add boundary check to prevent registered_fb[FB_MAX] access.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5c3f5a25c62230b7965804ce7a2e9305c3ca3961`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < cbe740de32bb0fb7a5213731ff5f26ea6718fca3`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 806f85bdd3a60187c21437fc51baace11f659f35`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2828a433c7d7a05b6f27c8148502095101dd0b09`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 248b2aab9b2af5ecf89d9d7955a2ff20c4b4a399`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 523b84dc7ccea9c4d79126d6ed1cf9033cf83b05`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.