CVE-2025-23159

Updated: 2025-11-10 02:52:47.091095

Description:

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases.


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x 0.0
CVSS Version 3.x MEDIUM 5.5

Status

OS name Project name Version Score Severity Status Errata Last updated

Statement

AlmaLinux 9.2 ESU kernel 5.14.0 5.5 MEDIUM Ignored 2025-11-11 02:53:40 This flaw only affects systems that load the Qualcomm Venus V4L2 driver and expose the Venus hardwar...
CentOS 8.4 ELS kernel 4.18.0 5.5 MEDIUM Ignored 2025-11-11 02:53:41
CentOS 8.5 ELS kernel 4.18.0 5.5 MEDIUM Ignored 2025-11-11 02:53:42
CentOS Stream 8 ELS kernel 4.18.0 5.5 MEDIUM Ignored 2025-11-11 02:53:40
Oracle Linux 7 ELS kernel-uek 5.4.17 5.5 MEDIUM Released CLSA-2025:1757963029 2025-09-16 11:20:58
TuxCare 9.6 ESU kernel 5.14.0 5.5 MEDIUM Ignored 2025-11-11 02:53:41 Deprioritize: this bug is confined to the Qualcomm “Venus” V4L2 video accelerator driver used on...
Ubuntu 16.04 ELS linux-hwe 4.15.0 5.5 MEDIUM Ignored 2025-11-11 02:54:35
Ubuntu 18.04 ELS linux 4.15.0 5.5 MEDIUM Ignored 2025-11-11 02:54:21
Ubuntu 20.04 ELS linux 5.4.0 5.5 MEDIUM Ignored 2025-11-11 02:54:21