CVE-2022-49978

fbdev: fb_pm2fb: Avoid potential divide by zero error

State: Published
Severity: Not scored
Published: Jun 18, 2025
Updated: May 11, 2026
Reserved: Jun 18, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: fb_pm2fb: Avoid potential divide by zero error

In `do_fb_ioctl()` of fbmem.c, if cmd is FBIOPUT_VSCREENINFO, var will be copied from user, then go through `fb_set_var()` and `info->fbops->fb_check_var()` which could may be `pm2fb_check_var()`. Along the path, `var->pixclock` won't be modified. This function checks whether reciprocal of `var->pixclock` is too high. If `var->pixclock` is zero, there will be a divide by zero error. So, it is necessary to check whether denominator is zero to avoid crash. As this bug is found by Syzkaller, logs are listed below.

divide error in pm2fb_check_var Call Trace: <TASK> fb_set_var+0x367/0xeb0 drivers/video/fbdev/core/fbmem.c:1015 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0f1174f4972ea9fad6becf8881d71adca8e9ca91Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3ec326a6a0d4667585ca595f438c7293e5ced7c4Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7f88cdfea8d7f4dbaf423d808241403b2bb945e4Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7d9591b32a9092fc6391a316b56e8016c6181c3dAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8fc778ee2fb2853f7a3531fa7273349640d8e4e9Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 34c3dea1189525cd533071ed5c176fc4ea8d982bAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cb4bb011a683532841344ca7f281b5e04389b4f8Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 19f953e7435644b81332dd632ba1b2d80b1e37afAffected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 4.9.327 through 4.9.Not affected 4.14.292 through 4.14.Not affected 4.19.257 through 4.19.Not affected 5.4.212 through 5.4.Not affected 5.10.141 through 5.10.Not affected 5.15.65 through 5.15.Not affected 5.19.7 through 5.19.*Not affected 6.0 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0f1174f4972ea9fad6becf8881d71adca8e9ca91Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3ec326a6a0d4667585ca595f438c7293e5ced7c4Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7f88cdfea8d7f4dbaf423d808241403b2bb945e4Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7d9591b32a9092fc6391a316b56e8016c6181c3dAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8fc778ee2fb2853f7a3531fa7273349640d8e4e9Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 34c3dea1189525cd533071ed5c176fc4ea8d982bAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cb4bb011a683532841344ca7f281b5e04389b4f8Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 19f953e7435644b81332dd632ba1b2d80b1e37afAffected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
4.9.327 through 4.9.*Not affected
4.14.292 through 4.14.*Not affected
4.19.257 through 4.19.*Not affected
5.4.212 through 5.4.*Not affected
5.10.141 through 5.10.*Not affected
5.15.65 through 5.15.*Not affected
5.19.7 through 5.19.*Not affected
6.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.