In the Linux kernel, the following vulnerability has been resolved:
fbdev: omapfb: Add 'plane' value check
Function dispcovlsetup is not intended to work with the value OMAPDSSWB of the enum parameter plane.
The value of this parameter is initialized in dssinitoverlays and in the current state of the code it cannot take this value so it's not a real problem.
For the purposes of defensive coding it wouldn't be superfluous to check the parameter value, because some functions down the call stack process this value correctly and some not.
For example, in dispcovlsetupglobalalpha it may lead to buffer overflow.
Add check for this value.
Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65481079285696413286642052554251223781",
"254359396765873136177161821146113775963",
"299681926909311883023472818932477126917",
"60554306861113796357036002912239335604",
"225808838804529228388674905946399243102"
]
},
"id": "CVE-2025-37851-0c4eea6c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52eafaa56f8f6d6a0cdff9282b25b4acbde34edc",
"target": {
"file": "drivers/video/fbdev/omap2/omapfb/dss/dispc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65481079285696413286642052554251223781",
"254359396765873136177161821146113775963",
"299681926909311883023472818932477126917",
"60554306861113796357036002912239335604",
"225808838804529228388674905946399243102"
]
},
"id": "CVE-2025-37851-143088b6",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a570efb4d877adbf3db2dc95487f2ba6bfdd148a",
"target": {
"file": "drivers/video/fbdev/omap2/omapfb/dss/dispc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "239152543861893136319914064798189212522",
"length": 984.0
},
"id": "CVE-2025-37851-281b756a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdf41d72e8b015d9ea68f5a1c0a79624e7c312aa",
"target": {
"file": "drivers/video/fbdev/omap2/omapfb/dss/dispc.c",
"function": "dispc_ovl_setup"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65481079285696413286642052554251223781",
"254359396765873136177161821146113775963",
"299681926909311883023472818932477126917",
"60554306861113796357036002912239335604",
"225808838804529228388674905946399243102"
]
},
"id": "CVE-2025-37851-3337344d",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b0a41589ee70529b20e1e0108d03f10c649bdc4",
"target": {
"file": "drivers/video/fbdev/omap2/omapfb/dss/dispc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "239152543861893136319914064798189212522",
"length": 984.0
},
"id": "CVE-2025-37851-4e344142",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4efd8ef5e40f2c7a4a91a5a9f03140bfa827da89",
"target": {
"file": "drivers/video/fbdev/omap2/omapfb/dss/dispc.c",
"function": "dispc_ovl_setup"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "239152543861893136319914064798189212522",
"length": 984.0
},
"id": "CVE-2025-37851-5ce63a21",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52eafaa56f8f6d6a0cdff9282b25b4acbde34edc",
"target": {
"file": "drivers/video/fbdev/omap2/omapfb/dss/dispc.c",
"function": "dispc_ovl_setup"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "239152543861893136319914064798189212522",
"length": 984.0
},
"id": "CVE-2025-37851-74a4754c",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fda15c5b96b883d62fb2d84a3a1422aa87717897",
"target": {
"file": "drivers/video/fbdev/omap2/omapfb/dss/dispc.c",
"function": "dispc_ovl_setup"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "239152543861893136319914064798189212522",
"length": 984.0
},
"id": "CVE-2025-37851-801cb235",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b0a41589ee70529b20e1e0108d03f10c649bdc4",
"target": {
"file": "drivers/video/fbdev/omap2/omapfb/dss/dispc.c",
"function": "dispc_ovl_setup"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65481079285696413286642052554251223781",
"254359396765873136177161821146113775963",
"299681926909311883023472818932477126917",
"60554306861113796357036002912239335604",
"225808838804529228388674905946399243102"
]
},
"id": "CVE-2025-37851-af485147",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdf41d72e8b015d9ea68f5a1c0a79624e7c312aa",
"target": {
"file": "drivers/video/fbdev/omap2/omapfb/dss/dispc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "239152543861893136319914064798189212522",
"length": 984.0
},
"id": "CVE-2025-37851-b87c5262",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a570efb4d877adbf3db2dc95487f2ba6bfdd148a",
"target": {
"file": "drivers/video/fbdev/omap2/omapfb/dss/dispc.c",
"function": "dispc_ovl_setup"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65481079285696413286642052554251223781",
"254359396765873136177161821146113775963",
"299681926909311883023472818932477126917",
"60554306861113796357036002912239335604",
"225808838804529228388674905946399243102"
]
},
"id": "CVE-2025-37851-c623daf1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fda15c5b96b883d62fb2d84a3a1422aa87717897",
"target": {
"file": "drivers/video/fbdev/omap2/omapfb/dss/dispc.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"65481079285696413286642052554251223781",
"254359396765873136177161821146113775963",
"299681926909311883023472818932477126917",
"60554306861113796357036002912239335604",
"225808838804529228388674905946399243102"
]
},
"id": "CVE-2025-37851-f85a80bc",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4efd8ef5e40f2c7a4a91a5a9f03140bfa827da89",
"target": {
"file": "drivers/video/fbdev/omap2/omapfb/dss/dispc.c"
}
}
]