CVE-2025-40302 (GCVE-0-2025-40302)
Vulnerability from cvelistv5
Published
2025-12-08 00:46
Modified
2026-08-05 12:09
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: forbid remove_bufs when legacy fileio is active vb2_ioctl_remove_bufs() call manipulates queue internal buffer list, potentially overwriting some pointers used by the legacy fileio access mode. Forbid that ioctl when fileio is active to protect internal queue state between subsequent read/write calls.
References
Impacted products
Vendor Product Version
Linux Linux Version: a3293a85381ec9680aa2929547fbc76c5d87a1b2
Version: a3293a85381ec9680aa2929547fbc76c5d87a1b2
Version: a3293a85381ec9680aa2929547fbc76c5d87a1b2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/common/videobuf2/videobuf2-v4l2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a6a493b985bfffac097a4e1be09f98b27729dca8",
              "status": "affected",
              "version": "a3293a85381ec9680aa2929547fbc76c5d87a1b2",
              "versionType": "git"
            },
            {
              "lessThan": "e819b34df0a7030a15c968d619fa8a3ed2455c7a",
              "status": "affected",
              "version": "a3293a85381ec9680aa2929547fbc76c5d87a1b2",
              "versionType": "git"
            },
            {
              "lessThan": "27afd6e066cfd80ddbe22a4a11b99174ac89cced",
              "status": "affected",
              "version": "a3293a85381ec9680aa2929547fbc76c5d87a1b2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/common/videobuf2/videobuf2-v4l2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: videobuf2: forbid remove_bufs when legacy fileio is active\n\nvb2_ioctl_remove_bufs() call manipulates queue internal buffer list,\npotentially overwriting some pointers used by the legacy fileio access\nmode. Forbid that ioctl when fileio is active to protect internal queue\nstate between subsequent read/write calls."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires opening a V4L2 device node (/dev/videoN) and issuing read()/write() plus the VIDIOC_REMOVE_BUFS ioctl from a local process. There is no network-reachable path into videobuf2\u0027s legacy fileio emulator.\nAC:L - The attack is a purely sequential, deterministic three-step sequence on a single file descriptor (read/write \u2192 REMOVE_BUFS \u2192 read/write) with no race window; the same fd owns the queue so vb2_queue_is_busy() never blocks it. No special memory layout or timing beyond attacker control is required.\nPR:L - Any local unprivileged user with access to the video device node can trigger this \u2014 desktop distros grant the active session user access via logind uaccess ACLs/the video group, and Android/embedded camera sandboxes expose these nodes directly. No CAP_SYS_ADMIN or other capability is checked on the ioctl path.\nUI:N - The attacking process performs every step itself on its own file descriptor; no victim action, mount, or plug-in event is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - After the buffers are freed, __vb2_perform_fileio() still does copy_to_user(data, buf-\u003evaddr + buf-\u003epos, count) using the stale cached kernel address, disclosing up to a full frame (potentially megabytes) of freed kernel memory \u2014 reusable by kernel stacks, slab objects, or page tables \u2014 directly to userspace.\nI:H - On output/write queues the same stale pointer is used in copy_from_user(buf-\u003evaddr + buf-\u003epos, data, count), giving an attacker-controlled write of arbitrary length into freed kernel memory (vfree\u0027d vmalloc region reusable by VMAP kernel stacks, or page-allocator pages with dma-contig), a classic UAF write primitive for privilege escalation; a NULL-pointer write via b-\u003eplanes[0].bytesused also occurs.\nA:H - vb2_get_buffer() returns NULL for the removed index despite the code asserting it \"can never be NULL when using fileio\", producing a NULL-pointer dereference oops, and the use-after-free of vfree\u0027d vmalloc addresses causes unrecoverable kernel faults."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:21.585Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a6a493b985bfffac097a4e1be09f98b27729dca8"
        },
        {
          "url": "https://git.kernel.org/stable/c/e819b34df0a7030a15c968d619fa8a3ed2455c7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/27afd6e066cfd80ddbe22a4a11b99174ac89cced"
        }
      ],
      "title": "media: videobuf2: forbid remove_bufs when legacy fileio is active",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40302",
    "datePublished": "2025-12-08T00:46:26.293Z",
    "dateReserved": "2025-04-16T07:20:57.185Z",
    "dateUpdated": "2026-08-05T12:09:21.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.