Out-of-bounds write in Linux kernel - CVE-2025-23158
Published: May 2, 2025 / Updated: May 10, 2025
Vulnerability identifier: #VU108383
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-23158
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write within the venus_write_queue() and venus_read_queue() functions in drivers/media/platform/qcom/venus/hfi_venus.c. A local user can execute arbitrary code.
How to mitigate CVE-2025-23158
Install update from vendor's website.
Sources
- https://git.kernel.org/stable/c/101a86619aab42bb61f2253bbf720121022eab86
- https://git.kernel.org/stable/c/1b86c1917e16bafbbb08ab90baaff533aa36c62d
- https://git.kernel.org/stable/c/32af5c1fdb9bc274f52ee0472d3b060b18e4aab4
- https://git.kernel.org/stable/c/40084302f639b3fe954398c5ba5ee556b7242b54
- https://git.kernel.org/stable/c/679424f8b31446f90080befd0300ea915485b096
- https://git.kernel.org/stable/c/69baf245b23e20efda0079238b27fc63ecf13de1
- https://git.kernel.org/stable/c/a45957bcde529169188929816775a575de77d84f
- https://git.kernel.org/stable/c/cf5f7bb4e0d786f4d9d50ae6b5963935eab71d75
- https://git.kernel.org/stable/c/edb89d69b1438681daaf5ca90aed3242df94cc96
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.13.12