CVE-2025-38427

video: screen_info: Relocate framebuffers behind PCI bridges

published July 25, 2025

CVSS
—
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

video: screen_info: Relocate framebuffers behind PCI bridges

Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes

invalid access to I/O memory.

Resources behind a PCI host bridge can be relocated by a certain offset

in the kernel's CPU address range used for I/O. The framebuffer memory

range stored in screen_info refers to the CPU addresses as seen during

boot (where the offset is 0). During boot up, firmware may assign a

different memory offset to the PCI host bridge and thereby relocating

the framebuffer address of the PCI graphics device as seen by the kernel.

The information in screen_info must be updated as well.

The helper pcibios_bus_to_resource() performs the relocation of the

screen_info's framebuffer resource (given in PCI bus addresses). The

result matches the I/O-memory resource of the PCI graphics device (given

in CPU addresses). As before, we store away the information necessary to

later update the information in screen_info itself.

Commit 78aa89d1dfba ("firmware/sysfb: Update screen_info for relocated

EFI framebuffers") added the code for updating screen_info. It is based

on similar functionality that pre-existed in efifb. Efifb uses a pointer

to the PCI resource, while the newer code does a memcpy of the region.

Hence efifb sees any updates to the PCI resource and avoids the issue.

v3:

- Only use struct pci_bus_region for PCI bus addresses (Bjorn)

- Clarify address semantics in commit messages and comments (Bjorn)

v2:

- Fixed tags (Takashi, Ivan)

- Updated information on efifb

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.7th percentile
Published
2025-07-25T14:16Z
EPSS history
Timeline
  • 25 JUL 14:16Z
    video: screen_info: Relocate framebuffers behind PCI bridges
    cvelistv5