video: screen_info: Relocate framebuffers behind PCI bridges

Summary

In the Linux kernel, the following vulnerability has been resolved: video: screen_info: Relocate framebuffers behind PCI bridges Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes invalid access to I/O memory. Resources behind a PCI host bridge can be relocated by a certain offset in the kernel's CPU address range used for I/O. The framebuffer memory range stored in screen_info refers to the CPU addresses as seen during boot (where the offset is 0). During boot up, firmware may assign a different memory offset to the PCI host bridge and thereby relocating the framebuffer address of the PCI graphics device as seen by the kernel. The information in screen_info must be updated as well. The helper pcibios_bus_to_resource() performs the relocation of the screen_info's framebuffer resource (given in PCI bus addresses). The result matches the I/O-memory resource of the PCI graphics device (given in CPU addresses). As before, we store away the information necessary to later update the information in screen_info itself. Commit 78aa89d1dfba ("firmware/sysfb: Update screen_info for relocated EFI framebuffers") added the code for updating screen_info. It is based on similar functionality that pre-existed in efifb. Efifb uses a pointer to the PCI resource, while the newer code does a memcpy of the region. Hence efifb sees any updates to the PCI resource and avoids the issue. v3: • Only use struct pci_bus_region for PCI bus addresses (Bjorn) • Clarify address semantics in commit messages and comments (Bjorn) v2: • Fixed tags (Takashi, Ivan) • Updated information on efifb

Timeline

1. Jul 25, 2025, 2:16 PM UTCCVE published
2. May 23, 2026, 3:59 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 6.6.45 · fixed in 6.6.95

• Linux Linux

  6.9

References 4