Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]video: screen_info: Relocate framebuffers behind PCI bridges[EOL][EOL]Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes[EOL]invalid access to I/O memory.[EOL][EOL]Resources behind a PCI host bridge can be relocated by a certain offset[EOL]in the kernel's CPU address range used for I/O. The framebuffer memory[EOL]range stored in screen_info refers to the CPU addresses as seen during[EOL]boot (where the offset is 0). During boot up, firmware may assign a[EOL]different memory offset to the PCI host bridge and thereby relocating[EOL]the framebuffer address of the PCI graphics device as seen by the kernel.[EOL]The information in screen_info must be updated as well.[EOL][EOL]The helper pcibios_bus_to_resource() performs the relocation of the[EOL]screen_info's framebuffer resource (given in PCI bus addresses). The[EOL]result matches the I/O-memory resource of the PCI graphics device (given[EOL]in CPU addresses). As before, we store away the information necessary to[EOL]later update the information in screen_info itself.[EOL][EOL]Commit 78aa89d1dfba ("firmware/sysfb: Update screen_info for relocated[EOL]EFI framebuffers") added the code for updating screen_info. It is based[EOL]on similar functionality that pre-existed in efifb. Efifb uses a pointer[EOL]to the PCI resource, while the newer code does a memcpy of the region.[EOL]Hence efifb sees any updates to the PCI resource and avoids the issue.[EOL][EOL]v3:[EOL]- Only use struct pci_bus_region for PCI bus addresses (Bjorn)[EOL]- Clarify address semantics in commit messages and comments (Bjorn)[EOL]v2:[EOL]- Fixed tags (Takashi, Ivan)[EOL]- Updated information on efifb

CREATE(Triage):(User=admin) [CVE-2025-38427 (https://nvd.nist.gov/vuln/detail/CVE-2025-38427)

CVEs

• CVE-2025-38427