CVE-2025-38226 (GCVE-0-2025-38226)
Vulnerability from cvelistv5
Published
2025-07-04 13:37
Modified
2026-08-05 12:00
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: media: vivid: Change the siize of the composing syzkaller found a bug: BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 Write of size 1440 at addr ffffc9000d0ffda0 by task vivid-000-vid-c/5304 CPU: 0 UID: 0 PID: 5304 Comm: vivid-000-vid-c Not tainted 6.14.0-rc2-syzkaller-00039-g09fbf3d50205 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline] vivid_thread_vid_cap_tick+0xf8e/0x60d0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629 vivid_thread_vid_cap+0x8aa/0xf30 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> The composition size cannot be larger than the size of fmt_cap_rect. So execute v4l2_rect_map_inside() even if has_compose_cap == 0.
References
Impacted products
Vendor Product Version
Linux Linux Version: 54f259906039dbfe46c550011409fa16f72370f6
Version: f9d19f3a044ca651b0be52a4bf951ffe74259b9f
Version: ab54081a2843aefb837812fac5488cc8f1696142
Version: 2f558c5208b0f70c8140e08ce09fcc84da48e789
Version: 94a7ad9283464b75b12516c5512541d467cefcf8
Version: 94a7ad9283464b75b12516c5512541d467cefcf8
Version: 94a7ad9283464b75b12516c5512541d467cefcf8
Version: 94a7ad9283464b75b12516c5512541d467cefcf8
Version: 8c0ee15d9a102c732d0745566d254040085d5663
Version: 5edc3604151919da8da0fb092b71d7dce07d848a
Version: 9c7fba9503b826f0c061d136f8f0c9f953ed18b9
Version: ccb5392c4fea0e7d9f7ab35567e839d74cb3998b
Version: 5.4.229   ≤
Version: 5.10.163   ≤
Version: 5.15.86   ≤
Version: 6.1.2   ≤
Version: 4.9.337   ≤
Version: 4.14.303   ≤
Version: 4.19.270   ≤
Version: 6.0.16   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:35:42.979Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "57597d8db5bbda618ba2145b7e8a7e6f01b6a27e",
              "status": "affected",
              "version": "54f259906039dbfe46c550011409fa16f72370f6",
              "versionType": "git"
            },
            {
              "lessThan": "635cea4f44c1ddae208666772c164eab5a6bce39",
              "status": "affected",
              "version": "f9d19f3a044ca651b0be52a4bf951ffe74259b9f",
              "versionType": "git"
            },
            {
              "lessThan": "89b5ab822bf69867c3951dd0eb34b0314c38966b",
              "status": "affected",
              "version": "ab54081a2843aefb837812fac5488cc8f1696142",
              "versionType": "git"
            },
            {
              "lessThan": "5d89aa42534723400fefd46e26e053b9c382b4ee",
              "status": "affected",
              "version": "2f558c5208b0f70c8140e08ce09fcc84da48e789",
              "versionType": "git"
            },
            {
              "lessThan": "f6b1b0f8ba0b61d8b511df5649d57235f230c135",
              "status": "affected",
              "version": "94a7ad9283464b75b12516c5512541d467cefcf8",
              "versionType": "git"
            },
            {
              "lessThan": "00da1c767a6567e56f23dda586847586868ac064",
              "status": "affected",
              "version": "94a7ad9283464b75b12516c5512541d467cefcf8",
              "versionType": "git"
            },
            {
              "lessThan": "c56398885716d97ee9bcadb2bc9663a8c1757a34",
              "status": "affected",
              "version": "94a7ad9283464b75b12516c5512541d467cefcf8",
              "versionType": "git"
            },
            {
              "lessThan": "f83ac8d30c43fd902af7c84c480f216157b60ef0",
              "status": "affected",
              "version": "94a7ad9283464b75b12516c5512541d467cefcf8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8c0ee15d9a102c732d0745566d254040085d5663",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5edc3604151919da8da0fb092b71d7dce07d848a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c7fba9503b826f0c061d136f8f0c9f953ed18b9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ccb5392c4fea0e7d9f7ab35567e839d74cb3998b",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.296",
              "status": "affected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.239",
              "status": "affected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.186",
              "status": "affected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.142",
              "status": "affected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "5.4.229",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "5.10.163",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "5.15.86",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "6.1.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.337",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.303",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.270",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vivid: Change the siize of the composing\n\nsyzkaller found a bug:\n\nBUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline]\nBUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705\nWrite of size 1440 at addr ffffc9000d0ffda0 by task vivid-000-vid-c/5304\n\nCPU: 0 UID: 0 PID: 5304 Comm: vivid-000-vid-c Not tainted 6.14.0-rc2-syzkaller-00039-g09fbf3d50205 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:489\n kasan_report+0x143/0x180 mm/kasan/report.c:602\n kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106\n tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline]\n tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705\n vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline]\n vivid_thread_vid_cap_tick+0xf8e/0x60d0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629\n vivid_thread_vid_cap+0x8aa/0xf30 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767\n kthread+0x7a9/0x920 kernel/kthread.c:464\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \u003c/TASK\u003e\n\nThe composition size cannot be larger than the size of fmt_cap_rect.\nSo execute v4l2_rect_map_inside() even if has_compose_cap == 0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached exclusively through ioctls (VIDIOC_S_EXT_CTRLS, VIDIOC_S_FMT, VIDIOC_S_SELECTION, VIDIOC_REQBUFS, VIDIOC_STREAMON) on the local /dev/videoN character device exposed by the vivid driver. No network or adjacent-network component is involved.\nAC:L - The desync is produced by a deterministic, fully attacker-controlled ioctl sequence (disable composing, keep the scaler, then set a small crop rect) with no race and no dependence on memory layout; syzkaller reproduces it reliably. The size of the overflow is directly chosen by the attacker via the crop rectangle.\nPR:L - The attacker only needs to open the vivid video node, which any local unprivileged user in the video group or with a logind/udev ACL on an active seat can do; no CAP_SYS_ADMIN or other capability is checked anywhere on the path. All the toggles (has_compose_cap, has_scaler_cap, has_crop_cap) are ordinary unprivileged V4L2 controls.\nUI:N - The attacking process performs every step itself \u2014 configuring controls, format, selection, queueing buffers and starting streaming \u2014 and the overflow is then executed autonomously by the vivid capture kthread. No victim action is required.\nS:U - The out-of-bounds write corrupts kernel memory within the same security authority as the kernel itself; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The geometry desync makes the driver operate on memory beyond the allocated frame buffer, and in the video-loop path (vivid_copy_buffer) the mismatched compose_cap offsets are used for both source and destination copies, so out-of-bounds data can be copied into a buffer the attacker reads back; more generally this heap corruption is leverageable for kernel information disclosure.\nI:H - This is an out-of-bounds write past a vb2 frame buffer with attacker-chosen length (up to hundreds of KB) and, via the video-loop copy path, largely attacker-chosen content at an attacker-chosen offset \u2014 a classic heap-overflow primitive suitable for corrupting adjacent kernel objects and hijacking control flow.\nA:H - The overflow immediately writes past the vmalloc\u0027d capture buffer into the guard page or into adjacent allocations, producing a kernel oops/panic in the vivid kthread (as shown by the KASAN vmalloc-out-of-bounds report), and it can be re-triggered at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:29.016Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/57597d8db5bbda618ba2145b7e8a7e6f01b6a27e"
        },
        {
          "url": "https://git.kernel.org/stable/c/635cea4f44c1ddae208666772c164eab5a6bce39"
        },
        {
          "url": "https://git.kernel.org/stable/c/89b5ab822bf69867c3951dd0eb34b0314c38966b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d89aa42534723400fefd46e26e053b9c382b4ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6b1b0f8ba0b61d8b511df5649d57235f230c135"
        },
        {
          "url": "https://git.kernel.org/stable/c/00da1c767a6567e56f23dda586847586868ac064"
        },
        {
          "url": "https://git.kernel.org/stable/c/c56398885716d97ee9bcadb2bc9663a8c1757a34"
        },
        {
          "url": "https://git.kernel.org/stable/c/f83ac8d30c43fd902af7c84c480f216157b60ef0"
        }
      ],
      "title": "media: vivid: Change the siize of the composing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38226",
    "datePublished": "2025-07-04T13:37:40.977Z",
    "dateReserved": "2025-04-16T04:51:23.995Z",
    "dateUpdated": "2026-08-05T12:00:29.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.