CVE-2025-68296

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup

Protect vga_switcheroo_client_fb_set() with console lock. Avoids OOB

access in fbcon_remap_all(). Without holding the console lock the call

races with switching outputs.

VGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon

function uses struct fb_info.node, which is set by register_framebuffer().

As the fb-helper code currently sets up VGA switcheroo before registering

the framebuffer, the value of node is -1 and therefore not a legal value.

For example, fbcon uses the value within set_con2fb_map() [1] as an index

into an array.

Moving vga_switcheroo_client_fb_set() after register_framebuffer() can

result in VGA switching that does not switch fbcon correctly.

Therefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(),

which already holds the console lock. Fbdev calls fbcon_fb_registered()

from within register_framebu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References