Log in Start free

Vulnerability · Published May 1, 2025 · Assigned by Linux

CVE-2025-23158media: venus: hfi: add check to handle incorrect queue size

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 86.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add check to handle incorrect queue size qsize represents size of shared queued between driver and video firmware. Firmware can modify this value to an invalid large value. In such situation, empty_space will be bigger than the space actually available. Since new_wr_idx is not checked, so the following code will result in an OOB write. ... qsize = qhdr->q_size if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx) .... if (new_wr_idx < qsize) { memcpy(wr_ptr, packet, dwords << 2) --> OOB write Add check to ensure qsize is within the allocated size while reading and writing packets into the queue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.135-1DEBIAN-CVE-2025-23158
Debian:13linux6.12.25-1DEBIAN-CVE-2025-23158
Debian:14linux6.12.25-1DEBIAN-CVE-2025-23158
Ubuntu:22.04:LTSlinux5.15.0-144.157UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux5.15.0-144.157USN-7654-1
Ubuntu:24.04:LTSlinux6.8.0-100.100USN-8028-1
Ubuntu:24.04:LTSlinux6.8.0-100.100UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-aws5.15.0-1088.95UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-aws5.15.0-1088.95USN-7654-1
Ubuntu:24.04:LTSlinux-aws6.8.0-1046.49UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-aws6.8.0-1046.49USN-8028-5
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1046.49~22.04.1USN-8028-5
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1046.49~22.04.1UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-azure5.15.0-1094.103UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-azure5.15.0-1094.103USN-7711-1
Ubuntu:24.04:LTSlinux-azure6.8.0-1046.52USN-8074-1
Ubuntu:24.04:LTSlinux-azure6.8.0-1046.52UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1051.57~22.04.1USN-8126-1
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1051.57~22.04.1UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1094.103.1UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-azure-fde6.8.0-1046.53UBUNTU-CVE-2025-23158
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-azure-fde-6.86.8.0-1046.53~22.04.1UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-gcp5.15.0-1087.96UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-gcp5.15.0-1087.96USN-7654-1
Ubuntu:24.04:LTSlinux-gcp6.8.0-1047.50USN-8031-3
Ubuntu:24.04:LTSlinux-gcp6.8.0-1047.50UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1047.50~22.04.2USN-8031-1
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1047.50~22.04.2UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-gke5.15.0-1085.91USN-7654-1
Ubuntu:22.04:LTSlinux-gke5.15.0-1085.91UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-gke6.8.0-1043.48UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-gke6.8.0-1043.48USN-8031-3
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1070.78USN-7654-1
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1070.78UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1030.33UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1030.33USN-8028-5
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-100.100~22.04.1UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-100.100~22.04.1USN-8028-6
Ubuntu:22.04:LTSlinux-ibm5.15.0-1080.83UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-ibm5.15.0-1080.83USN-7654-1
Ubuntu:24.04:LTSlinux-ibm6.8.0-1044.44UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-ibm6.8.0-1044.44USN-8028-8
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1044.44~22.04.1UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1044.44~22.04.1USN-8028-8
Ubuntu:24.04:LTSlinux-intelno fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1083.89UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1083.89USN-7654-1
Ubuntu:22.04:LTSlinux-kvm5.15.0-1084.89USN-7654-4
Ubuntu:22.04:LTSlinux-kvm5.15.0-1084.89UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-144.157USN-7654-1
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-144.157UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-100.100.1USN-8052-1
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-100.100.1UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-100.100.1~22.04.1UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-100.100.1~22.04.1USN-8028-6
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1082.83UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1082.83USN-7654-1
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1046.49UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1046.49USN-8028-5
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1046.49~22.04.1UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1046.49~22.04.1USN-8028-5
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1046.49.1USN-8028-7
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1046.49.1UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1041.41USN-7654-1
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1041.41UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1020.20UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1030.30UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1030.30USN-7654-1
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-oracle5.15.0-1085.91USN-7654-1
Ubuntu:22.04:LTSlinux-oracle5.15.0-1085.91UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-oracle6.8.0-1043.44USN-8028-5
Ubuntu:24.04:LTSlinux-oracle6.8.0-1043.44UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1043.44~22.04.1USN-8028-5
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1043.44~22.04.1UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-raspi5.15.0-1083.86UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-raspi6.8.0-1047.51UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-raspi6.8.0-1047.51USN-8028-1
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-100.100~22.04.1UBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2025-23158
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1023.24UBUNTU-CVE-2025-23158
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1023.24USN-8052-2
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1052.56USN-7654-5
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1052.56UBUNTU-CVE-2025-23158

Affected products (as reported)

VendorProductVersions
Linux Linux d96d3f30c0f2f564f6922bf4ccdf4464992e31fb – before 1b86c1917e16bafbbb08ab90baaff533aa36c62dd96d3f30c0f2f564f6922bf4ccdf4464992e31fb – before a45957bcde529169188929816775a575de77d84fd96d3f30c0f2f564f6922bf4ccdf4464992e31fb – before 32af5c1fdb9bc274f52ee0472d3b060b18e4aab4d96d3f30c0f2f564f6922bf4ccdf4464992e31fb – before cf5f7bb4e0d786f4d9d50ae6b5963935eab71d75d96d3f30c0f2f564f6922bf4ccdf4464992e31fb – before 40084302f639b3fe954398c5ba5ee556b7242b54d96d3f30c0f2f564f6922bf4ccdf4464992e31fb – before 679424f8b31446f90080befd0300ea915485b096d96d3f30c0f2f564f6922bf4ccdf4464992e31fb – before edb89d69b1438681daaf5ca90aed3242df94cc96d96d3f30c0f2f564f6922bf4ccdf4464992e31fb – before 101a86619aab42bb61f2253bbf720121022eab86
Linux Linux 4.13

References