CVE-2025-38226 (GCVE-0-2025-38226)

Vulnerability from cvelistv5 – Published: 2025-07-04 13:37 – Updated: 2026-08-05 12:00
VLAI
Title
media: vivid: Change the siize of the composing
Summary
In the Linux kernel, the following vulnerability has been resolved: media: vivid: Change the siize of the composing syzkaller found a bug: BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 Write of size 1440 at addr ffffc9000d0ffda0 by task vivid-000-vid-c/5304 CPU: 0 UID: 0 PID: 5304 Comm: vivid-000-vid-c Not tainted 6.14.0-rc2-syzkaller-00039-g09fbf3d50205 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline] vivid_thread_vid_cap_tick+0xf8e/0x60d0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629 vivid_thread_vid_cap+0x8aa/0xf30 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> The composition size cannot be larger than the size of fmt_cap_rect. So execute v4l2_rect_map_inside() even if has_compose_cap == 0.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 54f259906039dbfe46c550011409fa16f72370f6 , < 57597d8db5bbda618ba2145b7e8a7e6f01b6a27e (git)
Affected: f9d19f3a044ca651b0be52a4bf951ffe74259b9f , < 635cea4f44c1ddae208666772c164eab5a6bce39 (git)
Affected: ab54081a2843aefb837812fac5488cc8f1696142 , < 89b5ab822bf69867c3951dd0eb34b0314c38966b (git)
Affected: 2f558c5208b0f70c8140e08ce09fcc84da48e789 , < 5d89aa42534723400fefd46e26e053b9c382b4ee (git)
Affected: 94a7ad9283464b75b12516c5512541d467cefcf8 , < f6b1b0f8ba0b61d8b511df5649d57235f230c135 (git)
Affected: 94a7ad9283464b75b12516c5512541d467cefcf8 , < 00da1c767a6567e56f23dda586847586868ac064 (git)
Affected: 94a7ad9283464b75b12516c5512541d467cefcf8 , < c56398885716d97ee9bcadb2bc9663a8c1757a34 (git)
Affected: 94a7ad9283464b75b12516c5512541d467cefcf8 , < f83ac8d30c43fd902af7c84c480f216157b60ef0 (git)
Affected: 8c0ee15d9a102c732d0745566d254040085d5663 (git)
Affected: 5edc3604151919da8da0fb092b71d7dce07d848a (git)
Affected: 9c7fba9503b826f0c061d136f8f0c9f953ed18b9 (git)
Affected: ccb5392c4fea0e7d9f7ab35567e839d74cb3998b (git)
Affected: 5.4.229 , < 5.4.296 (semver)
Affected: 5.10.163 , < 5.10.239 (semver)
Affected: 5.15.86 , < 5.15.186 (semver)
Affected: 6.1.2 , < 6.1.142 (semver)
Affected: 4.9.337 , < 4.10 (semver)
Affected: 4.14.303 , < 4.15 (semver)
Affected: 4.19.270 , < 4.20 (semver)
Affected: 6.0.16 , < 6.1 (semver)
Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 5.4.296 , ≤ 5.4.* (semver)
Unaffected: 5.10.239 , ≤ 5.10.* (semver)
Unaffected: 5.15.186 , ≤ 5.15.* (semver)
Unaffected: 6.1.142 , ≤ 6.1.* (semver)
Unaffected: 6.6.95 , ≤ 6.6.* (semver)
Unaffected: 6.12.35 , ≤ 6.12.* (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:35:42.979Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "57597d8db5bbda618ba2145b7e8a7e6f01b6a27e",
              "status": "affected",
              "version": "54f259906039dbfe46c550011409fa16f72370f6",
              "versionType": "git"
            },
            {
              "lessThan": "635cea4f44c1ddae208666772c164eab5a6bce39",
              "status": "affected",
              "version": "f9d19f3a044ca651b0be52a4bf951ffe74259b9f",
              "versionType": "git"
            },
            {
              "lessThan": "89b5ab822bf69867c3951dd0eb34b0314c38966b",
              "status": "affected",
              "version": "ab54081a2843aefb837812fac5488cc8f1696142",
              "versionType": "git"
            },
            {
              "lessThan": "5d89aa42534723400fefd46e26e053b9c382b4ee",
              "status": "affected",
              "version": "2f558c5208b0f70c8140e08ce09fcc84da48e789",
              "versionType": "git"
            },
            {
              "lessThan": "f6b1b0f8ba0b61d8b511df5649d57235f230c135",
              "status": "affected",
              "version": "94a7ad9283464b75b12516c5512541d467cefcf8",
              "versionType": "git"
            },
            {
              "lessThan": "00da1c767a6567e56f23dda586847586868ac064",
              "status": "affected",
              "version": "94a7ad9283464b75b12516c5512541d467cefcf8",
              "versionType": "git"
            },
            {
              "lessThan": "c56398885716d97ee9bcadb2bc9663a8c1757a34",
              "status": "affected",
              "version": "94a7ad9283464b75b12516c5512541d467cefcf8",
              "versionType": "git"
            },
            {
              "lessThan": "f83ac8d30c43fd902af7c84c480f216157b60ef0",
              "status": "affected",
              "version": "94a7ad9283464b75b12516c5512541d467cefcf8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8c0ee15d9a102c732d0745566d254040085d5663",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5edc3604151919da8da0fb092b71d7dce07d848a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c7fba9503b826f0c061d136f8f0c9f953ed18b9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ccb5392c4fea0e7d9f7ab35567e839d74cb3998b",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.296",
              "status": "affected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.239",
              "status": "affected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.186",
              "status": "affected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.142",
              "status": "affected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "5.4.229",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "5.10.163",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "5.15.86",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "6.1.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.337",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.303",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.270",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vivid: Change the siize of the composing\n\nsyzkaller found a bug:\n\nBUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline]\nBUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705\nWrite of size 1440 at addr ffffc9000d0ffda0 by task vivid-000-vid-c/5304\n\nCPU: 0 UID: 0 PID: 5304 Comm: vivid-000-vid-c Not tainted 6.14.0-rc2-syzkaller-00039-g09fbf3d50205 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:489\n kasan_report+0x143/0x180 mm/kasan/report.c:602\n kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106\n tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline]\n tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705\n vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline]\n vivid_thread_vid_cap_tick+0xf8e/0x60d0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629\n vivid_thread_vid_cap+0x8aa/0xf30 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767\n kthread+0x7a9/0x920 kernel/kthread.c:464\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \u003c/TASK\u003e\n\nThe composition size cannot be larger than the size of fmt_cap_rect.\nSo execute v4l2_rect_map_inside() even if has_compose_cap == 0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached exclusively through ioctls (VIDIOC_S_EXT_CTRLS, VIDIOC_S_FMT, VIDIOC_S_SELECTION, VIDIOC_REQBUFS, VIDIOC_STREAMON) on the local /dev/videoN character device exposed by the vivid driver. No network or adjacent-network component is involved.\nAC:L - The desync is produced by a deterministic, fully attacker-controlled ioctl sequence (disable composing, keep the scaler, then set a small crop rect) with no race and no dependence on memory layout; syzkaller reproduces it reliably. The size of the overflow is directly chosen by the attacker via the crop rectangle.\nPR:L - The attacker only needs to open the vivid video node, which any local unprivileged user in the video group or with a logind/udev ACL on an active seat can do; no CAP_SYS_ADMIN or other capability is checked anywhere on the path. All the toggles (has_compose_cap, has_scaler_cap, has_crop_cap) are ordinary unprivileged V4L2 controls.\nUI:N - The attacking process performs every step itself \u2014 configuring controls, format, selection, queueing buffers and starting streaming \u2014 and the overflow is then executed autonomously by the vivid capture kthread. No victim action is required.\nS:U - The out-of-bounds write corrupts kernel memory within the same security authority as the kernel itself; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The geometry desync makes the driver operate on memory beyond the allocated frame buffer, and in the video-loop path (vivid_copy_buffer) the mismatched compose_cap offsets are used for both source and destination copies, so out-of-bounds data can be copied into a buffer the attacker reads back; more generally this heap corruption is leverageable for kernel information disclosure.\nI:H - This is an out-of-bounds write past a vb2 frame buffer with attacker-chosen length (up to hundreds of KB) and, via the video-loop copy path, largely attacker-chosen content at an attacker-chosen offset \u2014 a classic heap-overflow primitive suitable for corrupting adjacent kernel objects and hijacking control flow.\nA:H - The overflow immediately writes past the vmalloc\u0027d capture buffer into the guard page or into adjacent allocations, producing a kernel oops/panic in the vivid kthread (as shown by the KASAN vmalloc-out-of-bounds report), and it can be re-triggered at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:29.016Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/57597d8db5bbda618ba2145b7e8a7e6f01b6a27e"
        },
        {
          "url": "https://git.kernel.org/stable/c/635cea4f44c1ddae208666772c164eab5a6bce39"
        },
        {
          "url": "https://git.kernel.org/stable/c/89b5ab822bf69867c3951dd0eb34b0314c38966b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d89aa42534723400fefd46e26e053b9c382b4ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6b1b0f8ba0b61d8b511df5649d57235f230c135"
        },
        {
          "url": "https://git.kernel.org/stable/c/00da1c767a6567e56f23dda586847586868ac064"
        },
        {
          "url": "https://git.kernel.org/stable/c/c56398885716d97ee9bcadb2bc9663a8c1757a34"
        },
        {
          "url": "https://git.kernel.org/stable/c/f83ac8d30c43fd902af7c84c480f216157b60ef0"
        }
      ],
      "title": "media: vivid: Change the siize of the composing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38226",
    "datePublished": "2025-07-04T13:37:40.977Z",
    "dateReserved": "2025-04-16T04:51:23.995Z",
    "dateUpdated": "2026-08-05T12:00:29.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38226",
      "date": "2026-08-06",
      "epss": "0.00162",
      "percentile": "0.05837"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:21:45.000Z",
      "cve": "CVE-2025-38226",
      "id": "msrc_CVE-2025-38226",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "media: vivid: Change the siize of the composing",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38226.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38226\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-04T14:15:31.367\",\"lastModified\":\"2026-07-30T06:23:01.220\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: vivid: Change the siize of the composing\\n\\nsyzkaller found a bug:\\n\\nBUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline]\\nBUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705\\nWrite of size 1440 at addr ffffc9000d0ffda0 by task vivid-000-vid-c/5304\\n\\nCPU: 0 UID: 0 PID: 5304 Comm: vivid-000-vid-c Not tainted 6.14.0-rc2-syzkaller-00039-g09fbf3d50205 #0\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\\n\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:94 [inline]\\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\\n print_address_description mm/kasan/report.c:378 [inline]\\n print_report+0x169/0x550 mm/kasan/report.c:489\\n kasan_report+0x143/0x180 mm/kasan/report.c:602\\n kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\\n __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106\\n tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline]\\n tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705\\n vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline]\\n vivid_thread_vid_cap_tick+0xf8e/0x60d0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629\\n vivid_thread_vid_cap+0x8aa/0xf30 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767\\n kthread+0x7a9/0x920 kernel/kthread.c:464\\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148\\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\\n \u003c/TASK\u003e\\n\\nThe composition size cannot be larger than the size of fmt_cap_rect.\\nSo execute v4l2_rect_map_inside() even if has_compose_cap == 0.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: vivid: Cambiar el tama\u00f1o de la composici\u00f3n syzkaller encontr\u00f3 un error: ERROR: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 Write of size 1440 at addr ffffc9000d0ffda0 by task vivid-000-vid-c/5304 CPU: 0 UID: 0 PID: 5304 Comm: vivid-000-vid-c Not tainted 6.14.0-rc2-syzkaller-00039-g09fbf3d50205 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace:  __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline] vivid_thread_vid_cap_tick+0xf8e/0x60d0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629 vivid_thread_vid_cap+0x8aa/0xf30 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244  The composition size cannot be larger than the size of fmt_cap_rect. So execute v4l2_rect_map_inside() even if has_compose_cap == 0. \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/media/test-drivers/vivid/vivid-vid-cap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"54f259906039dbfe46c550011409fa16f72370f6\",\"lessThan\":\"57597d8db5bbda618ba2145b7e8a7e6f01b6a27e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f9d19f3a044ca651b0be52a4bf951ffe74259b9f\",\"lessThan\":\"635cea4f44c1ddae208666772c164eab5a6bce39\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ab54081a2843aefb837812fac5488cc8f1696142\",\"lessThan\":\"89b5ab822bf69867c3951dd0eb34b0314c38966b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f558c5208b0f70c8140e08ce09fcc84da48e789\",\"lessThan\":\"5d89aa42534723400fefd46e26e053b9c382b4ee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"94a7ad9283464b75b12516c5512541d467cefcf8\",\"lessThan\":\"f6b1b0f8ba0b61d8b511df5649d57235f230c135\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"94a7ad9283464b75b12516c5512541d467cefcf8\",\"lessThan\":\"00da1c767a6567e56f23dda586847586868ac064\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"94a7ad9283464b75b12516c5512541d467cefcf8\",\"lessThan\":\"c56398885716d97ee9bcadb2bc9663a8c1757a34\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"94a7ad9283464b75b12516c5512541d467cefcf8\",\"lessThan\":\"f83ac8d30c43fd902af7c84c480f216157b60ef0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8c0ee15d9a102c732d0745566d254040085d5663\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5edc3604151919da8da0fb092b71d7dce07d848a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9c7fba9503b826f0c061d136f8f0c9f953ed18b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ccb5392c4fea0e7d9f7ab35567e839d74cb3998b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.229\",\"lessThan\":\"5.4.296\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.163\",\"lessThan\":\"5.10.239\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.86\",\"lessThan\":\"5.15.186\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.2\",\"lessThan\":\"6.1.142\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.337\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.303\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.270\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.0.16\",\"lessThan\":\"6.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/media/test-drivers/vivid/vivid-vid-cap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.296\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.239\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.186\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.142\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.95\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.35\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.4\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9.337\",\"versionEndExcluding\":\"4.10\",\"matchCriteriaId\":\"0C8C5100-ECF6-4F64-9489-EFC7923A7591\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.303\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"68B456F6-323E-4372-A707-523AAA068DF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.270\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"C08F8902-A527-4C5E-A1BC-1DA79FBF4CB1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.229\",\"versionEndExcluding\":\"5.4.296\",\"matchCriteriaId\":\"0CB7FAEE-4AE1-4C9B-8F26-9D6BB32904C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.163\",\"versionEndExcluding\":\"5.10.239\",\"matchCriteriaId\":\"BAB0445C-DA1D-4080-899A-75E070E70D1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.86\",\"versionEndExcluding\":\"5.15.186\",\"matchCriteriaId\":\"30551F39-AF72-4A80-983A-6B7B905336C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.16\",\"versionEndExcluding\":\"6.1\",\"matchCriteriaId\":\"6C7522E3-150F-436D-BBD7-96C7B4B795ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.2\",\"versionEndExcluding\":\"6.1.142\",\"matchCriteriaId\":\"C0CB8C80-5654-402A-A4A2-A995D1C3108E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.95\",\"matchCriteriaId\":\"C5E01853-7048-4D78-9479-9AEE41AC8456\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.35\",\"matchCriteriaId\":\"E569FD34-0076-4428-BE17-EECCF867611C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.4\",\"matchCriteriaId\":\"DFD174C5-1AA2-4671-BDDC-1A9FCC753655\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/00da1c767a6567e56f23dda586847586868ac064\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/57597d8db5bbda618ba2145b7e8a7e6f01b6a27e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5d89aa42534723400fefd46e26e053b9c382b4ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/635cea4f44c1ddae208666772c164eab5a6bce39\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89b5ab822bf69867c3951dd0eb34b0314c38966b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c56398885716d97ee9bcadb2bc9663a8c1757a34\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f6b1b0f8ba0b61d8b511df5649d57235f230c135\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f83ac8d30c43fd902af7c84c480f216157b60ef0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:25:43+00:00",
      "cve": "CVE-2025-38226",
      "id": "CVE-2025-38226",
      "initial_release_date": "2025-07-04T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: vivid: Change the siize of the composing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38226.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-25T00:49:18Z",
      "cve": "CVE-2025-38226",
      "id": "CVE-2025-38226",
      "initial_release_date": "2025-07-07T23:23:38Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "323",
      "product_status:recommended": "508",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38226",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38226.json",
      "version": "43"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.