CVE-2025-38427

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

video: screen_info: Relocate framebuffers behind PCI bridges

Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes

invalid access to I/O memory.

Resources behind a PCI host bridge can be relocated by a certain offset

in the kernel's CPU address range used for I/O. The framebuffer memory

range stored in screen_info refers to the CPU addresses as seen during

boot (where the offset is 0). During boot up, firmware may assign a

different memory offset to the PCI host bridge and thereby relocating

the framebuffer address of the PCI graphics device as seen by the kernel.

The information in screen_info must be updated as well.

The helper pcibios_bus_to_resource() performs the relocation of the

screen_info's framebuffer resource (given in PCI bus addresses). The

result matches the I/O-memory resource of the PCI graphics device (given

in CPU addresses). As before, we store away the information necessary to

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References