Not yet scoredPublished Jul 10, 2025

CVE-2025-38312fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()

Updated under an hour ago (Oct 28, 2026, 5:25 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000, cvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's then passed to fb_cvt_hperiod(), where it's used as a divider -- division by 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to avoid such overflow... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Not yet received
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 96fe6a2109db29cd15b90a093c16e6cb4b19371a before 9027ce4c037b566b658b8939a76326b7125e3627; from 96fe6a2109db29cd15b90a093c16e6cb4b19371a before 610f247f2772e4f92b63442125a1b7ade79898d8; 96fe6a2109db29cd15b90a093c16e6cb4b19371a builds before 2d63433e8eaa3c91b2948190e395bc67009db0d9; from 96fe6a2109db29cd15b90a093c16e6cb4b19371a before 54947530663edcbaaee1314c01fdd8c72861b124; from 96fe6a2109db29cd15b90a093c16e6cb4b19371a before ab91647acdf43b984824776559a452212eaeb21a; from 96fe6a2109db29cd15b90a093c16e6cb4b19371a before b235393b9f43ff86a38ca2bde6372312ea215dc5; from 96fe6a2109db29cd15b90a093c16e6cb4b19371a before 53784073cbad18f75583fd3da9ffdfc4d1f05405; 96fe6a2109db29cd15b90a093c16e6cb4b19371a builds before 3f6dae09fc8c306eb70fdfef70726e1f154e173a	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP

References

References

https://git.kernel.org/stable/c/9027ce4c037b566b658b8939a76326b7125e3627
https://git.kernel.org/stable/c/610f247f2772e4f92b63442125a1b7ade79898d8
https://git.kernel.org/stable/c/2d63433e8eaa3c91b2948190e395bc67009db0d9
https://git.kernel.org/stable/c/54947530663edcbaaee1314c01fdd8c72861b124
https://git.kernel.org/stable/c/ab91647acdf43b984824776559a452212eaeb21a
https://git.kernel.org/stable/c/b235393b9f43ff86a38ca2bde6372312ea215dc5
https://git.kernel.org/stable/c/53784073cbad18f75583fd3da9ffdfc4d1f05405
https://git.kernel.org/stable/c/3f6dae09fc8c306eb70fdfef70726e1f154e173a

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.