CVE-2025-37851 | fbdev: omapfb: Add 'plane' value check

In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: Add 'plane' value check Function dispc_ovl_setup is not intended to work with the value OMAP_DSS_WB of the enum parameter plane. The value of this parameter is initialized in dss_init_overlays and in the current state of the code it cannot take this value so it's not a real problem. For the purposes of defensive coding it wouldn't be superfluous to check the parameter value, because some functions down the call stack process this value correctly and some not. For example, in dispc_ovl_setup_global_alpha it may lead to buffer overflow. Add check for this value. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool.

Published: 2025-05-09 Last update: 2026-06-17 Assigner: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Conclusion & alert: CVE-2025-37851 is rated Low Risk (27/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.23%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2025-37851

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.06% 0.23% +0.18%
2 2026-03-05 0.01% 0.06% +0.04%
3 2025-11-18 0.01%

Full EPSS history (7 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2025-37851

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.5 3.1 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
1.8 3.6 [email protected]

Weakness enumeration for CVE-2025-37851

OS Trackers for CVE-2025-37851

vendor priority summary link
debian not yet assigned CVE-2025-37851 not yet assigned priority: Debian including 2 source packages (linux, linux-6.1), 6 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 6. https://security-tracker.debian.org/tracker/CVE-2025-37851
redhat https://access.redhat.com/security/cve/CVE-2025-37851
suse medium https://www.suse.com/security/cve/CVE-2025-37851/
ubuntu medium CVE-2025-37851 medium priority: Ubuntu including 158 source packages (linux, linux-allwinner-5.19, …), 1551 status rows across 10 suites (bionic, focal, jammy, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 1145, ignored 168, released 162, needed 45, not-affected 28, needs-triage 2, pending 1. https://ubuntu.com/security/CVE-2025-37851

Affected software / configurations for CVE-2025-37851

Vendor Product Version Raw CPE
linux linux_kernel >= 2.6.33, < 5.4.293 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 5.5, < 5.10.237 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 5.11, < 5.15.181 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 5.16, < 6.1.135 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.2, < 6.6.88 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.7, < 6.12.24 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.13, < 6.13.12 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.14, < 6.14.3 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
debian debian_linux 11.0 cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

References for CVE-2025-37851

URL Tags
https://git.kernel.org/stable/c/09dbf22fd68c2f1a81ab89670ffa1ec3033436c4 Patch
https://git.kernel.org/stable/c/3e411827f31db7f938a30a3c7a7599839401ec30 Patch
https://git.kernel.org/stable/c/4efd8ef5e40f2c7a4a91a5a9f03140bfa827da89 Patch
https://git.kernel.org/stable/c/52eafaa56f8f6d6a0cdff9282b25b4acbde34edc Patch
https://git.kernel.org/stable/c/660a53a0694d1f3789802509fe729dd4656fc5e0 Patch
https://git.kernel.org/stable/c/9b0a41589ee70529b20e1e0108d03f10c649bdc4 Patch
https://git.kernel.org/stable/c/a570efb4d877adbf3db2dc95487f2ba6bfdd148a Patch
https://git.kernel.org/stable/c/cdf41d72e8b015d9ea68f5a1c0a79624e7c312aa Patch
https://git.kernel.org/stable/c/fda15c5b96b883d62fb2d84a3a1422aa87717897 Patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html Mailing List
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html Mailing List
cvelogic Threat Intelligence