CVE-2025-40302: media: videobuf2: forbid remove_bufs when legacy fileio is active
In the Linux kernel, the following vulnerability has been resolved:
media: videobuf2: forbid removebufs when legacy fileio is active
vb2ioctlremovebufs() call manipulates queue internal buffer list, potentially overwriting some pointers used by the legacy fileio access mode. Forbid that ioctl when fileio is active to protect internal queue state between subsequent read/write calls.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40302?
The severity of CVE-2025-40302 is considered high due to its impact on the management of buffer memory in the Linux kernel.
What software is affected by CVE-2025-40302?
CVE-2025-40302 affects the Linux Kernel, impacting systems where videobuf2 is used.
How do I fix CVE-2025-40302?
To fix CVE-2025-40302, you need to update the Linux kernel to the latest version that includes the patch for this vulnerability.
What is the impact of CVE-2025-40302 on legacy fileio access mode?
CVE-2025-40302 can potentially lead to pointer overwrites, compromising the stability and security of systems using legacy fileio access mode.
Is there a workaround for CVE-2025-40302 if immediate patching is not possible?
Currently, there are no known workarounds for CVE-2025-40302; updating the kernel is recommended.