CVE-2025-38680: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
In the Linux kernel, the following vulnerability has been resolved:
media: uvcvideo: Fix 1-byte out-of-bounds read in uvcparseformat()
The buffer length check before calling uvcparseformat() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes.
This can lead to an out-of-bounds read if the buffer has exactly 3 bytes.
Fix it by checking that the buffer has at least 4 bytes in uvcparseformat().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In uvc_parse_format(), check that the buffer has at least 4 bytes before accessing buffer[3].
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38680?
CVE-2025-38680 is classified as a medium severity vulnerability in the Linux kernel that involves an out-of-bounds read.
How do I fix CVE-2025-38680?
To fix CVE-2025-38680, update to the latest version of the Linux kernel where this vulnerability has been patched.
What components are affected by CVE-2025-38680?
CVE-2025-38680 specifically affects the uvcvideo component of the Linux kernel.
Can CVE-2025-38680 be exploited remotely?
CVE-2025-38680 does not appear to be directly exploitable remotely but may be triggered by local users manipulating video input.
What version of the Linux kernel contains the fix for CVE-2025-38680?
The fix for CVE-2025-38680 is included in the stable releases of the Linux kernel post the identified commit.