CVE-2025-68296 drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
A race condition in Linux kernel VGA switcheroo allows out-of-bounds access, potentially leading to denial of service or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68296?
CVE-2025-68296 is a vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
Protect vga_switcheroo_client_fb_set() with console lock. Avoids OOB access in fbcon_remap_all(). Without holding the console lock the call races with switching outputs.
VGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon function uses struct fb_info.node, which is set by register_framebuffer(). As the fb-helper code currently sets up VGA switcheroo before registering the framebuffer, the value of node is -1 and therefore not a legal value. For example, fbcon uses the value within set_con2fb_map() [1] as an index into an array.
Moving vga_switcheroo_client_fb_set() after register_framebuffer() can result in VGA switching that does not switch fbcon correctly.
Therefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(), which already holds the console lock. Fbdev calls fbcon_fb_registered() from within register_framebuffer(). Serializes the helper with VGA switcheroo's call to fbcon_remap_all().
Although vga_switcheroo_client_fb_set() takes an instance of struct fb_info as parameter, it really only needs the contained fbcon state. Moving the call to fbcon initialization is therefore cleaner than before. Only amdgpu, i915, nouveau and radeon support vga_switcheroo. For all other drivers, this change does nothing.
Which versions are affected by CVE-2025-68296?
How do I fix CVE-2025-68296?
Apply the vendor's patch.
Is CVE-2025-68296 being exploited?
There is no known exploitation of CVE-2025-68296 in the wild and no public exploit code.
Sources
Also known as AZL-72667, BELL-CVE-2025-68296, DEBIAN-CVE-2025-68296, GHSA-p2xg-mw87-vf49, ROOT-OS-DEBIAN-11-CVE-2025-68296, ROOT-OS-DEBIAN-12-CVE-2025-68296 and 4 more.