CVE-2025-38679media: venus: Fix OOB read due to missing payload bound check
Updated under an hour ago ()
Does this affect you?
It affects Linux and 3 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: venus: Fix OOB read due to missing payload bound check Currently, The event_seq_changed() handler processes a variable number of properties sent by the firmware. The number of properties is indicated by the firmware and used to iterate over the payload. However, the payload size is not being validated against the actual message length. This can lead to out-of-bounds memory access if the firmware provides a property count that exceeds the data available in the payload. Such a condition can result in kernel crashes or potential information leaks if memory beyond the buffer is accessed. Fix this by properly validating the remaining size of the payload before each property access and updating bounds accordingly as properties are parsed. This ensures that property parsing is safely bounded within the received message buffer and protects against malformed or malicious firmware behavior.
- CVSS
- 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Aug 5, 2026
- First seen by InfoSec Signals
- Oct 19, 2026
Affected products
Linux Linux linux:linux (from the name) | from 09c2845e8fe4fcab942929480203f504a6e0a114 before a3eef5847603cd8a4110587907988c3f93c9605a; 09c2845e8fe4fcab942929480203f504a6e0a114 builds before 8f274e2b05fdae7a53cee83979202b5ecb49035c; 09c2845e8fe4fcab942929480203f504a6e0a114 builds before 6f08bfb5805637419902f3d70069fe17a404545b; from 09c2845e8fe4fcab942929480203f504a6e0a114 before c956c3758510b448b3d4d10d1da8230e8c9bf668; from 09c2845e8fe4fcab942929480203f504a6e0a114 before bed4921055dd7bb4d2eea2729852ae18cf97a2c6; 09c2845e8fe4fcab942929480203f504a6e0a114 builds before 06d6770ff0d8cc8dfd392329a8cc03e2a83e7289 | CNA record |
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name) | before V5.0 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 4.13 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.43; from 6.13 before 6.15.11; from 6.16 before 6.16.2 | NVD |
debian debian_linux debian:debian_linux | 11.0 | NVD |
References
- https://git.kernel.org/stable/c/a3eef5847603cd8a4110587907988c3f93c9605apatch
- https://git.kernel.org/stable/c/8f274e2b05fdae7a53cee83979202b5ecb49035cpatch
- https://git.kernel.org/stable/c/6f08bfb5805637419902f3d70069fe17a404545bpatch
- https://git.kernel.org/stable/c/c956c3758510b448b3d4d10d1da8230e8c9bf668patch
- https://git.kernel.org/stable/c/bed4921055dd7bb4d2eea2729852ae18cf97a2c6patch
- https://git.kernel.org/stable/c/06d6770ff0d8cc8dfd392329a8cc03e2a83e7289patch
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlthird-party-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.