CVE-2025-38214 fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Fixes Null Pointer Dereference Vulnerabilities in fbdev Microsoft has published information regarding two vulnerabilities in the fbdev subsystem, identified as CVE-2025-38214 and CVE-2025-38215. Both vulnerabilities involve null pointer dereference issues in the fb_videomode_to_var function, which could potentially lead to system instability. The vulnerabilities were published on July 4, 2025, and have now been addressed with fixes. 2 sources 39