CVE-2024-35922: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-35922 is a vulnerability discovered in the Linux kernel's framebuffer monitor (fbmon) component, specifically in the fb_videomode_from_videomode() function. The vulnerability was discovered by the Linux Verification Center (linuxtesting.org) using their Svace analysis tool and was disclosed on May 19, 2024 (NVD).

The vulnerability stems from a potential division by zero condition in the fb_videomode_from_videomode() function. The issue occurs when the expression htotal * vtotal can have a zero value on overflow, requiring prevention of division by zero similar to the fb_var_to_videomode() function. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability could lead to a denial of service condition in the Linux kernel when processing framebuffer video modes. This affects various Linux kernel versions up to (excluding) 4.19.312, 5.4.274, 5.10.215, 5.15.155, and several other version ranges (NVD).

The vulnerability requires local access and low privileges to exploit. It has been classified as a CWE-369 (Divide By Zero) type vulnerability (NVD).

The vulnerability has been patched in multiple Linux kernel versions. The fix involves modifying the fb_videomode_from_videomode() function to properly handle the potential division by zero condition. The patch has been backported to various stable kernel versions and is available through distribution-specific updates (Kernel Patch).