In the Linux kernel, the following vulnerability has been resolved:
media: uvcvideo: Fix 1-byte out-of-bounds read in uvcparseformat()
The buffer length check before calling uvcparseformat() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes.
This can lead to an out-of-bounds read if the buffer has exactly 3 bytes.
Fix it by checking that the buffer has at least 4 bytes in uvcparseformat().
[
{
"deprecated": false,
"id": "CVE-2025-38680-0859a93f",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ad554217c9b945031c73df4e8176a475e2dea57",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_parse_format"
},
"digest": {
"function_hash": "60047441318666947047601138568477101427",
"length": 6504.0
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-14ca4b80",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e269581b3aa5962fdc52757ab40da286168c087",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_parse_format"
},
"digest": {
"function_hash": "296620146189245748775042706405675293840",
"length": 6600.0
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-2b45c308",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@782b6a718651eda3478b1824b37a8b3185d2740c",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"252138051244167476164750491443043802513",
"56816283522292574743981394252254313985",
"140916984660056988124812625137374922007"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-2f101a58",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffdd82182953df643aa63d999b6f1653d0c93778",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_parse_format"
},
"digest": {
"function_hash": "126116027478491709567193351034555982",
"length": 5877.0
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-3ec0d20e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8343f3fe0b755925f83d60b05e92bf4396879758",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"333342331656893459935621703224899131575",
"261672803445421630986943369452056049949",
"282453033088481110783149837337029300953"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-40a64419",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cac702a439050df65272c49184aef7975fe3eff2",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"333342331656893459935621703224899131575",
"261672803445421630986943369452056049949",
"332216026917212488642486825400983435262"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-749d4918",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a97e062e4ff3dab84a2f1eb811e9eddc6699e2a9",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"333342331656893459935621703224899131575",
"261672803445421630986943369452056049949",
"332216026917212488642486825400983435262"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-781d5b1e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a97e062e4ff3dab84a2f1eb811e9eddc6699e2a9",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_parse_format"
},
"digest": {
"function_hash": "81109510162255925971894047080163951360",
"length": 5908.0
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-7ef70951",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8343f3fe0b755925f83d60b05e92bf4396879758",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_parse_format"
},
"digest": {
"function_hash": "256974894194319730987718995835778648261",
"length": 5823.0
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-8336034e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffdd82182953df643aa63d999b6f1653d0c93778",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"333342331656893459935621703224899131575",
"261672803445421630986943369452056049949",
"282453033088481110783149837337029300953"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-89d558ef",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e269581b3aa5962fdc52757ab40da286168c087",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"333342331656893459935621703224899131575",
"261672803445421630986943369452056049949",
"282453033088481110783149837337029300953"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-8fa0824c",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@782b6a718651eda3478b1824b37a8b3185d2740c",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_parse_format"
},
"digest": {
"function_hash": "124329592111059483166412641161112231022",
"length": 4156.0
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-9f73339e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cac702a439050df65272c49184aef7975fe3eff2",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_parse_format"
},
"digest": {
"function_hash": "81109510162255925971894047080163951360",
"length": 5908.0
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-a4d19d35",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@424980d33b3f816485513e538610168b03fab9f1",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"252138051244167476164750491443043802513",
"56816283522292574743981394252254313985",
"140916984660056988124812625137374922007"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-b23fd6da",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@424980d33b3f816485513e538610168b03fab9f1",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_parse_format"
},
"digest": {
"function_hash": "124329592111059483166412641161112231022",
"length": 4156.0
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-b3c8a155",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d4a7c0b296162354b6fc759a1475b9d57ddfaa6",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_parse_format"
},
"digest": {
"function_hash": "124329592111059483166412641161112231022",
"length": 4156.0
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-b77357d7",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ad554217c9b945031c73df4e8176a475e2dea57",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"333342331656893459935621703224899131575",
"261672803445421630986943369452056049949",
"282453033088481110783149837337029300953"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-38680-f751ae95",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d4a7c0b296162354b6fc759a1475b9d57ddfaa6",
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"252138051244167476164750491443043802513",
"56816283522292574743981394252254313985",
"140916984660056988124812625137374922007"
]
}
}
]