CVE-2025-23159 (GCVE-0-2025-23159)

Vulnerability from cvelistv5 – Published: 2025-05-01 12:55 – Updated: 2026-08-05 11:57
VLAI
Title
media: venus: hfi: add a check to handle OOB in sfr region
Summary
In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d96d3f30c0f2f564f6922bf4ccdf4464992e31fb , < 4dd109038d513b92d4d33524ffc89ba32e02ba48 (git)
Affected: d96d3f30c0f2f564f6922bf4ccdf4464992e31fb , < 8879397c0da5e5ec1515262995e82cdfd61b282a (git)
Affected: d96d3f30c0f2f564f6922bf4ccdf4464992e31fb , < 1b8fb257234e7d2d4b3f48af07c5aa5e11c71634 (git)
Affected: d96d3f30c0f2f564f6922bf4ccdf4464992e31fb , < 4e95233af57715d81830fe82b408c633edff59f4 (git)
Affected: d96d3f30c0f2f564f6922bf4ccdf4464992e31fb , < 5af611c70fb889d46d2f654b8996746e59556750 (git)
Affected: d96d3f30c0f2f564f6922bf4ccdf4464992e31fb , < 530f623f56a6680792499a8404083e17f8ec51f4 (git)
Affected: d96d3f30c0f2f564f6922bf4ccdf4464992e31fb , < a062d8de0be5525ec8c52f070acf7607ec8cbfe4 (git)
Affected: d96d3f30c0f2f564f6922bf4ccdf4464992e31fb , < d78a8388a27b265fcb2b8d064f088168ac9356b0 (git)
Affected: d96d3f30c0f2f564f6922bf4ccdf4464992e31fb , < f4b211714bcc70effa60c34d9fa613d182e3ef1e (git)
Create a notification for this product.
Linux Linux Affected: 4.13
Unaffected: 0 , < 4.13 (semver)
Unaffected: 5.4.293 , ≤ 5.4.* (semver)
Unaffected: 5.10.237 , ≤ 5.10.* (semver)
Unaffected: 5.15.181 , ≤ 5.15.* (semver)
Unaffected: 6.1.135 , ≤ 6.1.* (semver)
Unaffected: 6.6.88 , ≤ 6.6.* (semver)
Unaffected: 6.12.24 , ≤ 6.12.* (semver)
Unaffected: 6.13.12 , ≤ 6.13.* (semver)
Unaffected: 6.14.3 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:42:59.661Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/qcom/venus/hfi_venus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4dd109038d513b92d4d33524ffc89ba32e02ba48",
              "status": "affected",
              "version": "d96d3f30c0f2f564f6922bf4ccdf4464992e31fb",
              "versionType": "git"
            },
            {
              "lessThan": "8879397c0da5e5ec1515262995e82cdfd61b282a",
              "status": "affected",
              "version": "d96d3f30c0f2f564f6922bf4ccdf4464992e31fb",
              "versionType": "git"
            },
            {
              "lessThan": "1b8fb257234e7d2d4b3f48af07c5aa5e11c71634",
              "status": "affected",
              "version": "d96d3f30c0f2f564f6922bf4ccdf4464992e31fb",
              "versionType": "git"
            },
            {
              "lessThan": "4e95233af57715d81830fe82b408c633edff59f4",
              "status": "affected",
              "version": "d96d3f30c0f2f564f6922bf4ccdf4464992e31fb",
              "versionType": "git"
            },
            {
              "lessThan": "5af611c70fb889d46d2f654b8996746e59556750",
              "status": "affected",
              "version": "d96d3f30c0f2f564f6922bf4ccdf4464992e31fb",
              "versionType": "git"
            },
            {
              "lessThan": "530f623f56a6680792499a8404083e17f8ec51f4",
              "status": "affected",
              "version": "d96d3f30c0f2f564f6922bf4ccdf4464992e31fb",
              "versionType": "git"
            },
            {
              "lessThan": "a062d8de0be5525ec8c52f070acf7607ec8cbfe4",
              "status": "affected",
              "version": "d96d3f30c0f2f564f6922bf4ccdf4464992e31fb",
              "versionType": "git"
            },
            {
              "lessThan": "d78a8388a27b265fcb2b8d064f088168ac9356b0",
              "status": "affected",
              "version": "d96d3f30c0f2f564f6922bf4ccdf4464992e31fb",
              "versionType": "git"
            },
            {
              "lessThan": "f4b211714bcc70effa60c34d9fa613d182e3ef1e",
              "status": "affected",
              "version": "d96d3f30c0f2f564f6922bf4ccdf4464992e31fb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/qcom/venus/hfi_venus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.293",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.237",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.293",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.237",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.181",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.135",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.88",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.24",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.12",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.3",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi: add a check to handle OOB in sfr region\n\nsfr-\u003ebuf_size is in shared memory and can be modified by malicious user.\nOOB write is possible when the size is made higher than actual sfr data\nbuffer. Cap the size to allocated size for such cases."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The untrusted input is `sfr-\u003ebuf_size` in a DMA-coherent region shared with the on-SoC Venus video firmware, reached through the local HFI message queue and IRQ thread, not through any network stack. No physical access or device attachment is needed \u2014 the video core is on-die and its firmware can be subverted purely in software via a hostile bitstream fed to the codec.\nAC:L - The entity writing the SFR region controls `buf_size` and every byte of `sfr-\u003edata` directly, so filling the 4 KiB buffer with non-NUL bytes and posting one EVENT_NOTIFY/SYS_ERROR packet triggers the OOB scan and write deterministically. There is no race, timing window, or uncontrolled memory-layout precondition required to reach the flaw.\nPR:N - The vulnerable path is armed from driver probe (`core.c:465-473`) and executes in the venus IRQ thread with no syscall, file descriptor, credential, or capability check anywhere along it \u2014 `hfi_process_msg_packet()` even skips session validation for EVENT_NOTIFY. The attacker holds no OS-level privileges, matching how other malicious-device/firmware-data kernel CVEs are scored.\nUI:N - A SYS_ERROR event notification is consumed by the interrupt thread whenever it arrives, including during unattended background decode or immediately after boot. No local user or administrator has to open, mount, or click anything.\nS:U - The out-of-bounds read and write both land in the host kernel\u0027s own memory, the same security authority as the vulnerable venus driver. No VM, hypervisor, or IOMMU protection boundary is crossed by the impact itself.\nC:H - `memchr()` scans up to 4 GiB beyond a 4 KiB allocation and the following `dev_err_ratelimited(\"%s\", sfr-\u003edata)` prints from the buffer until the first NUL, so arbitrary quantities of adjacent kernel memory are copied verbatim into the kernel log. This is an unbounded OOB read with a built-in exfiltration channel, not a few stray bytes.\nI:H - `sfr-\u003edata[sfr-\u003ebuf_size - 1] = \u0027\\0\u0027` is an out-of-bounds write of a zero byte at an offset chosen entirely by the attacker, up to ~4 GiB past the 4 KiB DMA buffer. A controlled-offset write into adjacent kernel structures (flags, refcount or pointer bytes) is exploitable memory corruption.\nA:H - The DMA buffer is a single 4 KiB vmapped/CMA page, so scanning or writing past it faults on unmapped memory and oopses inside the venus IRQ thread. Corrupting a neighbouring kernel object with the stray NUL byte likewise leads to a panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:10.567Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4dd109038d513b92d4d33524ffc89ba32e02ba48"
        },
        {
          "url": "https://git.kernel.org/stable/c/8879397c0da5e5ec1515262995e82cdfd61b282a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b8fb257234e7d2d4b3f48af07c5aa5e11c71634"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e95233af57715d81830fe82b408c633edff59f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/5af611c70fb889d46d2f654b8996746e59556750"
        },
        {
          "url": "https://git.kernel.org/stable/c/530f623f56a6680792499a8404083e17f8ec51f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/a062d8de0be5525ec8c52f070acf7607ec8cbfe4"
        },
        {
          "url": "https://git.kernel.org/stable/c/d78a8388a27b265fcb2b8d064f088168ac9356b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4b211714bcc70effa60c34d9fa613d182e3ef1e"
        }
      ],
      "title": "media: venus: hfi: add a check to handle OOB in sfr region",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-23159",
    "datePublished": "2025-05-01T12:55:44.695Z",
    "dateReserved": "2025-01-11T14:28:41.515Z",
    "dateUpdated": "2026-08-05T11:57:10.567Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-23159",
      "date": "2026-08-07",
      "epss": "0.00214",
      "percentile": "0.11834"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-23159\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T13:15:51.843\",\"lastModified\":\"2026-07-30T06:22:18.043\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: venus: hfi: add a check to handle OOB in sfr region\\n\\nsfr-\u003ebuf_size is in shared memory and can be modified by malicious user.\\nOOB write is possible when the size is made higher than actual sfr data\\nbuffer. Cap the size to allocated size for such cases.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: venus: hfi: se ha a\u00f1adido una comprobaci\u00f3n para gestionar la escritura OOB en la regi\u00f3n sfr. sfr-\u0026gt;buf_size se encuentra en memoria compartida y puede ser modificado por un usuario malintencionado. Es posible escribir OOB cuando el tama\u00f1o es mayor que el del b\u00fafer de datos sfr. En estos casos, limite el tama\u00f1o al tama\u00f1o asignado.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/media/platform/qcom/venus/hfi_venus.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb\",\"lessThan\":\"4dd109038d513b92d4d33524ffc89ba32e02ba48\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb\",\"lessThan\":\"8879397c0da5e5ec1515262995e82cdfd61b282a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb\",\"lessThan\":\"1b8fb257234e7d2d4b3f48af07c5aa5e11c71634\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb\",\"lessThan\":\"4e95233af57715d81830fe82b408c633edff59f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb\",\"lessThan\":\"5af611c70fb889d46d2f654b8996746e59556750\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb\",\"lessThan\":\"530f623f56a6680792499a8404083e17f8ec51f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb\",\"lessThan\":\"a062d8de0be5525ec8c52f070acf7607ec8cbfe4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb\",\"lessThan\":\"d78a8388a27b265fcb2b8d064f088168ac9356b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb\",\"lessThan\":\"f4b211714bcc70effa60c34d9fa613d182e3ef1e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/media/platform/qcom/venus/hfi_venus.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.293\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.237\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.181\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.135\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.88\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.24\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.12\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.3\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.13\",\"versionEndExcluding\":\"5.4.293\",\"matchCriteriaId\":\"4355CEDC-A5C9-44FC-9709-B12432D81407\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.237\",\"matchCriteriaId\":\"0710B81E-E2FA-4E15-8F68-D297EBB4D50D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.181\",\"matchCriteriaId\":\"12331C9E-F601-4EFC-899E-369F98DCC70B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.135\",\"matchCriteriaId\":\"5B9ACE29-7445-4B6F-B761-6367C005E275\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.88\",\"matchCriteriaId\":\"6E5947E5-45E3-462A-829B-382B3B1C61BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.24\",\"matchCriteriaId\":\"1D35A8A8-F3EC-45E6-AD37-1F154B27529D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.12\",\"matchCriteriaId\":\"4A475784-BF3B-4514-81EE-49C8522FB24A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.14.3\",\"matchCriteriaId\":\"483E2E15-2135-4EC6-AB64-16282C5EF704\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1b8fb257234e7d2d4b3f48af07c5aa5e11c71634\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4dd109038d513b92d4d33524ffc89ba32e02ba48\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4e95233af57715d81830fe82b408c633edff59f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/530f623f56a6680792499a8404083e17f8ec51f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5af611c70fb889d46d2f654b8996746e59556750\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8879397c0da5e5ec1515262995e82cdfd61b282a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a062d8de0be5525ec8c52f070acf7607ec8cbfe4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d78a8388a27b265fcb2b8d064f088168ac9356b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f4b211714bcc70effa60c34d9fa613d182e3ef1e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:30:45+00:00",
      "cve": "CVE-2025-23159",
      "id": "CVE-2025-23159",
      "initial_release_date": "2025-05-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: venus: hfi: add a check to handle OOB in sfr region",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-23159.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-15T06:20:58Z",
      "cve": "CVE-2025-23159",
      "id": "CVE-2025-23159",
      "initial_release_date": "2025-05-02T02:03:39Z",
      "product_status:known_affected": "557",
      "product_status:known_not_affected": "143",
      "product_status:recommended": "380",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-23159",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-23159.json",
      "version": "38"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.