CVE-2023-38409

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.12Mailing List, Release Notes
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=fffb0b52d5258554c645c966c6cbef7de50b851dMailing List, Patch
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.12Mailing List, Release Notes
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=fffb0b52d5258554c645c966c6cbef7de50b851dMailing List, Patch

Timeline

Published: Jul 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-38418.8A vulnerability has been found in NxFilter 4.3.2.5 and classified as problematic. This vulnerability affects unknown code of the file user.j CVE-2023-384107.8The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A user may be able to ele CVE-2023-384117.8Improper access control in the Intel Smart Campus android application before version 9.4 may allow an authenticated user to potentially enab CVE-2023-384128.8Netgear R6900P v1.3.3.154 was discovered to contain multiple buffer overflows via the wla_ssid and wlg_ssid parameters at ia_ap_setting.cgi.CVE-2023-384174.3Improper input validation for some Intel(R) PROSet/Wireless WiFi software before version 23.20 may allow an unauthenticated user to potentia CVE-2023-384187.8The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: So CVE-2023-384194.3An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests. CVE-2023-38427.8A vulnerability was found in Pointware EasyInventory 1.0.12.0 and classified as critical. This issue affects some unknown processing of the CVE-2023-384203.8Improper conditions check in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable inf CVE-2023-384215.5The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5, macOS Monterey 12.6.8. Processing a 3D model may re CVE-2023-384227.5Walchem Intuition 9 firmware versions prior to v4.21 are missing authentication for some of the API routes of the management web server. Thi CVE-2023-384235.4A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run