CVE-2025-71136: media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status()
In the Linux kernel, the following vulnerability has been resolved:
media: adv7842: Avoid possible out-of-bounds array accesses in adv7842cplogstatus()
It's possible for cpread() and hdmiread() to return -EIO. Those values are further used as indexes for accessing arrays.
Fix that by checking return values where it's needed.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In media: adv7842, check the return values of cp_read() and hdmi_read() in adv7842_cp_log_status() before using them as array indexes, handling -EIO returns to prevent out-of-bounds accesses.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71136?
CVE-2025-71136 is considered a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-71136?
To fix CVE-2025-71136, update your Linux kernel to the patched version provided by your distribution.
What does CVE-2025-71136 affect?
CVE-2025-71136 affects the Linux kernel and specifically targets the adv7842 component.
What are the potential impacts of CVE-2025-71136?
Exploitation of CVE-2025-71136 may lead to out-of-bounds array accesses, potentially compromising system stability.
When was CVE-2025-71136 reported?
CVE-2025-71136 was reported as a vulnerability in the Linux kernel that addresses out-of-bounds array accesses.