CVE-2025-38427: In the Linux kernel, the following vulnerability has been resolved: video: screen_info: Relocate framebuffers behind PC
Summary
A Linux kernel vulnerability allowed invalid access to graphics memory (framebuffer) when PCI host bridges relocated memory addresses during boot. The fix applies PCI address offsets to the framebuffer information stored in screen_info (a kernel data structure tracking display memory locations) so the kernel uses the correct updated memory addresses instead of the original boot-time addresses.
Solution / Mitigation
The helper function pcibios_bus_to_resource() performs the relocation of the screen_info framebuffer resource, and commit 78aa89d1dfba ("firmware/sysfb: Update screen_info for relocated EFI framebuffers") added code to update screen_info with the corrected addresses. This approach mirrors similar existing functionality in efifb (the EFI framebuffer driver).
Vulnerability Details
5.5(medium)
EPSS: 0.0%
Classification
Taxonomy References
Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-38427
First tracked: February 15, 2026 at 08:35 PM
Classified by LLM (prompt v3) · confidence: 95%