GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-68296 (GCVE-0-2025-68296)

Vulnerability from cvelistv5 – Published: 2025-12-16 15:06 – Updated: 2026-06-19 11:57
VLAI
Title
drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
Summary
In the Linux kernel, the following vulnerability has been resolved: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup Protect vga_switcheroo_client_fb_set() with console lock. Avoids OOB access in fbcon_remap_all(). Without holding the console lock the call races with switching outputs. VGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon function uses struct fb_info.node, which is set by register_framebuffer(). As the fb-helper code currently sets up VGA switcheroo before registering the framebuffer, the value of node is -1 and therefore not a legal value. For example, fbcon uses the value within set_con2fb_map() [1] as an index into an array. Moving vga_switcheroo_client_fb_set() after register_framebuffer() can result in VGA switching that does not switch fbcon correctly. Therefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(), which already holds the console lock. Fbdev calls fbcon_fb_registered() from within register_framebuffer(). Serializes the helper with VGA switcheroo's call to fbcon_remap_all(). Although vga_switcheroo_client_fb_set() takes an instance of struct fb_info as parameter, it really only needs the contained fbcon state. Moving the call to fbcon initialization is therefore cleaner than before. Only amdgpu, i915, nouveau and radeon support vga_switcheroo. For all other drivers, this change does nothing.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6a9ee8af344e3bd7dbd61e67037096cdf7f83289 , < 711ebd961190def4c69ea24b2f0be75e995af24a (git)
Affected: 6a9ee8af344e3bd7dbd61e67037096cdf7f83289 , < 482330f8261b4bea8146d9bd69c1199e5dfcbb5c (git)
Affected: 6a9ee8af344e3bd7dbd61e67037096cdf7f83289 , < 05814c389b53d2f3a0b9eeb90ba7a05ba77c4c2a (git)
Affected: 6a9ee8af344e3bd7dbd61e67037096cdf7f83289 , < eb76d0f5553575599561010f24c277cc5b31d003 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.34
Unaffected: 0 , < 2.6.34 (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.61 , ≤ 6.12.* (semver)
Unaffected: 6.17.11 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_fb_helper.c",
            "drivers/video/fbdev/core/fbcon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "711ebd961190def4c69ea24b2f0be75e995af24a",
              "status": "affected",
              "version": "6a9ee8af344e3bd7dbd61e67037096cdf7f83289",
              "versionType": "git"
            },
            {
              "lessThan": "482330f8261b4bea8146d9bd69c1199e5dfcbb5c",
              "status": "affected",
              "version": "6a9ee8af344e3bd7dbd61e67037096cdf7f83289",
              "versionType": "git"
            },
            {
              "lessThan": "05814c389b53d2f3a0b9eeb90ba7a05ba77c4c2a",
              "status": "affected",
              "version": "6a9ee8af344e3bd7dbd61e67037096cdf7f83289",
              "versionType": "git"
            },
            {
              "lessThan": "eb76d0f5553575599561010f24c277cc5b31d003",
              "status": "affected",
              "version": "6a9ee8af344e3bd7dbd61e67037096cdf7f83289",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_fb_helper.c",
            "drivers/video/fbdev/core/fbcon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.61",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.11",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup\n\nProtect vga_switcheroo_client_fb_set() with console lock. Avoids OOB\naccess in fbcon_remap_all(). Without holding the console lock the call\nraces with switching outputs.\n\nVGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon\nfunction uses struct fb_info.node, which is set by register_framebuffer().\nAs the fb-helper code currently sets up VGA switcheroo before registering\nthe framebuffer, the value of node is -1 and therefore not a legal value.\nFor example, fbcon uses the value within set_con2fb_map() [1] as an index\ninto an array.\n\nMoving vga_switcheroo_client_fb_set() after register_framebuffer() can\nresult in VGA switching that does not switch fbcon correctly.\n\nTherefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(),\nwhich already holds the console lock. Fbdev calls fbcon_fb_registered()\nfrom within register_framebuffer(). Serializes the helper with VGA\nswitcheroo\u0027s call to fbcon_remap_all().\n\nAlthough vga_switcheroo_client_fb_set() takes an instance of struct fb_info\nas parameter, it really only needs the contained fbcon state. Moving the\ncall to fbcon initialization is therefore cleaner than before. Only amdgpu,\ni915, nouveau and radeon support vga_switcheroo. For all other drivers,\nthis change does nothing."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T11:57:24.114Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/711ebd961190def4c69ea24b2f0be75e995af24a"
        },
        {
          "url": "https://git.kernel.org/stable/c/482330f8261b4bea8146d9bd69c1199e5dfcbb5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/05814c389b53d2f3a0b9eeb90ba7a05ba77c4c2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb76d0f5553575599561010f24c277cc5b31d003"
        }
      ],
      "title": "drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68296",
    "datePublished": "2025-12-16T15:06:15.797Z",
    "dateReserved": "2025-12-16T14:48:05.293Z",
    "dateUpdated": "2026-06-19T11:57:24.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68296",
      "date": "2026-09-16",
      "epss": "0.00205",
      "percentile": "0.10778"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-26T01:39:42.000Z",
      "cve": "CVE-2025-68296",
      "id": "msrc_CVE-2025-68296",
      "initial_release_date": "2025-12-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "11",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-68296.json",
      "version": "13"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68296\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T16:16:08.540\",\"lastModified\":\"2026-06-19T13:16:24.050\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup\\n\\nProtect vga_switcheroo_client_fb_set() with console lock. Avoids OOB\\naccess in fbcon_remap_all(). Without holding the console lock the call\\nraces with switching outputs.\\n\\nVGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon\\nfunction uses struct fb_info.node, which is set by register_framebuffer().\\nAs the fb-helper code currently sets up VGA switcheroo before registering\\nthe framebuffer, the value of node is -1 and therefore not a legal value.\\nFor example, fbcon uses the value within set_con2fb_map() [1] as an index\\ninto an array.\\n\\nMoving vga_switcheroo_client_fb_set() after register_framebuffer() can\\nresult in VGA switching that does not switch fbcon correctly.\\n\\nTherefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(),\\nwhich already holds the console lock. Fbdev calls fbcon_fb_registered()\\nfrom within register_framebuffer(). Serializes the helper with VGA\\nswitcheroo\u0027s call to fbcon_remap_all().\\n\\nAlthough vga_switcheroo_client_fb_set() takes an instance of struct fb_info\\nas parameter, it really only needs the contained fbcon state. Moving the\\ncall to fbcon initialization is therefore cleaner than before. Only amdgpu,\\ni915, nouveau and radeon support vga_switcheroo. For all other drivers,\\nthis change does nothing.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/drm_fb_helper.c\",\"drivers/video/fbdev/core/fbcon.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6a9ee8af344e3bd7dbd61e67037096cdf7f83289\",\"lessThan\":\"711ebd961190def4c69ea24b2f0be75e995af24a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a9ee8af344e3bd7dbd61e67037096cdf7f83289\",\"lessThan\":\"482330f8261b4bea8146d9bd69c1199e5dfcbb5c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a9ee8af344e3bd7dbd61e67037096cdf7f83289\",\"lessThan\":\"05814c389b53d2f3a0b9eeb90ba7a05ba77c4c2a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6a9ee8af344e3bd7dbd61e67037096cdf7f83289\",\"lessThan\":\"eb76d0f5553575599561010f24c277cc5b31d003\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/drm_fb_helper.c\",\"drivers/video/fbdev/core/fbcon.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.34\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.34\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.143\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.61\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.11\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/05814c389b53d2f3a0b9eeb90ba7a05ba77c4c2a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/482330f8261b4bea8146d9bd69c1199e5dfcbb5c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/711ebd961190def4c69ea24b2f0be75e995af24a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eb76d0f5553575599561010f24c277cc5b31d003\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T01:42:51+00:00",
      "cve": "CVE-2025-68296",
      "id": "CVE-2025-68296",
      "initial_release_date": "2025-12-16T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service due to race condition in fbcon setup",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68296.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T13:40:23Z",
      "cve": "CVE-2025-68296",
      "id": "CVE-2025-68296",
      "initial_release_date": "2025-12-18T00:24:09Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "810",
      "product_status:recommended": "326",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68296",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68296.json",
      "version": "34"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.