In the Linux kernel, the following vulnerability has been resolved:
media: venus: hfi: add a check to handle OOB in sfr region
sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases.
[
{
"signature_type": "Function",
"id": "CVE-2025-23159-079d0dcc",
"target": {
"function": "venus_sfr_print",
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8879397c0da5e5ec1515262995e82cdfd61b282a",
"digest": {
"function_hash": "46597538136494794550796917301801764582",
"length": 330.0
}
},
{
"signature_type": "Function",
"id": "CVE-2025-23159-36ce03f5",
"target": {
"function": "venus_sfr_print",
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@530f623f56a6680792499a8404083e17f8ec51f4",
"digest": {
"function_hash": "46597538136494794550796917301801764582",
"length": 330.0
}
},
{
"signature_type": "Function",
"id": "CVE-2025-23159-51677520",
"target": {
"function": "venus_sfr_print",
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4b211714bcc70effa60c34d9fa613d182e3ef1e",
"digest": {
"function_hash": "46597538136494794550796917301801764582",
"length": 330.0
}
},
{
"signature_type": "Line",
"id": "CVE-2025-23159-6ef0ac1e",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4b211714bcc70effa60c34d9fa613d182e3ef1e",
"digest": {
"line_hashes": [
"144873396634831887328319399899731061647",
"10224187006829307026134464460787617909",
"60898897612572219440654361704661853738",
"223346493305345413306618884594845245600",
"267108509187701432824343059619434882667",
"231852860068490042065741349040832635254",
"301687667655994580480484884063713588522",
"215849832418503707652359889082680897269",
"7752938268164877785913935627307285183",
"209112218049446252346789343052649823652"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"id": "CVE-2025-23159-716beb95",
"target": {
"function": "venus_sfr_print",
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b8fb257234e7d2d4b3f48af07c5aa5e11c71634",
"digest": {
"function_hash": "46597538136494794550796917301801764582",
"length": 330.0
}
},
{
"signature_type": "Function",
"id": "CVE-2025-23159-735bb367",
"target": {
"function": "venus_sfr_print",
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d78a8388a27b265fcb2b8d064f088168ac9356b0",
"digest": {
"function_hash": "46597538136494794550796917301801764582",
"length": 330.0
}
},
{
"signature_type": "Function",
"id": "CVE-2025-23159-75819ab9",
"target": {
"function": "venus_sfr_print",
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a062d8de0be5525ec8c52f070acf7607ec8cbfe4",
"digest": {
"function_hash": "46597538136494794550796917301801764582",
"length": 330.0
}
},
{
"signature_type": "Line",
"id": "CVE-2025-23159-7d3df0e7",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b8fb257234e7d2d4b3f48af07c5aa5e11c71634",
"digest": {
"line_hashes": [
"144873396634831887328319399899731061647",
"10224187006829307026134464460787617909",
"60898897612572219440654361704661853738",
"223346493305345413306618884594845245600",
"267108509187701432824343059619434882667",
"231852860068490042065741349040832635254",
"301687667655994580480484884063713588522",
"215849832418503707652359889082680897269",
"7752938268164877785913935627307285183",
"209112218049446252346789343052649823652"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"id": "CVE-2025-23159-8717d323",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a062d8de0be5525ec8c52f070acf7607ec8cbfe4",
"digest": {
"line_hashes": [
"144873396634831887328319399899731061647",
"10224187006829307026134464460787617909",
"60898897612572219440654361704661853738",
"223346493305345413306618884594845245600",
"267108509187701432824343059619434882667",
"231852860068490042065741349040832635254",
"301687667655994580480484884063713588522",
"215849832418503707652359889082680897269",
"7752938268164877785913935627307285183",
"209112218049446252346789343052649823652"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"id": "CVE-2025-23159-8fe9173c",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8879397c0da5e5ec1515262995e82cdfd61b282a",
"digest": {
"line_hashes": [
"144873396634831887328319399899731061647",
"10224187006829307026134464460787617909",
"60898897612572219440654361704661853738",
"223346493305345413306618884594845245600",
"267108509187701432824343059619434882667",
"231852860068490042065741349040832635254",
"301687667655994580480484884063713588522",
"215849832418503707652359889082680897269",
"7752938268164877785913935627307285183",
"209112218049446252346789343052649823652"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"id": "CVE-2025-23159-98a37402",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d78a8388a27b265fcb2b8d064f088168ac9356b0",
"digest": {
"line_hashes": [
"144873396634831887328319399899731061647",
"10224187006829307026134464460787617909",
"60898897612572219440654361704661853738",
"223346493305345413306618884594845245600",
"267108509187701432824343059619434882667",
"231852860068490042065741349040832635254",
"301687667655994580480484884063713588522",
"215849832418503707652359889082680897269",
"7752938268164877785913935627307285183",
"209112218049446252346789343052649823652"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"id": "CVE-2025-23159-9d58706b",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5af611c70fb889d46d2f654b8996746e59556750",
"digest": {
"line_hashes": [
"144873396634831887328319399899731061647",
"10224187006829307026134464460787617909",
"60898897612572219440654361704661853738",
"223346493305345413306618884594845245600",
"267108509187701432824343059619434882667",
"231852860068490042065741349040832635254",
"301687667655994580480484884063713588522",
"215849832418503707652359889082680897269",
"7752938268164877785913935627307285183",
"209112218049446252346789343052649823652"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"id": "CVE-2025-23159-b0f141c9",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e95233af57715d81830fe82b408c633edff59f4",
"digest": {
"line_hashes": [
"144873396634831887328319399899731061647",
"10224187006829307026134464460787617909",
"60898897612572219440654361704661853738",
"223346493305345413306618884594845245600",
"267108509187701432824343059619434882667",
"231852860068490042065741349040832635254",
"301687667655994580480484884063713588522",
"215849832418503707652359889082680897269",
"7752938268164877785913935627307285183",
"209112218049446252346789343052649823652"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"id": "CVE-2025-23159-c2ecf94e",
"target": {
"function": "venus_sfr_print",
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e95233af57715d81830fe82b408c633edff59f4",
"digest": {
"function_hash": "46597538136494794550796917301801764582",
"length": 330.0
}
},
{
"signature_type": "Function",
"id": "CVE-2025-23159-e3d8d7a9",
"target": {
"function": "venus_sfr_print",
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4dd109038d513b92d4d33524ffc89ba32e02ba48",
"digest": {
"function_hash": "46597538136494794550796917301801764582",
"length": 330.0
}
},
{
"signature_type": "Function",
"id": "CVE-2025-23159-ebd14116",
"target": {
"function": "venus_sfr_print",
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5af611c70fb889d46d2f654b8996746e59556750",
"digest": {
"function_hash": "46597538136494794550796917301801764582",
"length": 330.0
}
},
{
"signature_type": "Line",
"id": "CVE-2025-23159-eefe1c66",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4dd109038d513b92d4d33524ffc89ba32e02ba48",
"digest": {
"line_hashes": [
"144873396634831887328319399899731061647",
"10224187006829307026134464460787617909",
"60898897612572219440654361704661853738",
"223346493305345413306618884594845245600",
"267108509187701432824343059619434882667",
"231852860068490042065741349040832635254",
"301687667655994580480484884063713588522",
"215849832418503707652359889082680897269",
"7752938268164877785913935627307285183",
"209112218049446252346789343052649823652"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"id": "CVE-2025-23159-fff2fd17",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@530f623f56a6680792499a8404083e17f8ec51f4",
"digest": {
"line_hashes": [
"144873396634831887328319399899731061647",
"10224187006829307026134464460787617909",
"60898897612572219440654361704661853738",
"223346493305345413306618884594845245600",
"267108509187701432824343059619434882667",
"231852860068490042065741349040832635254",
"301687667655994580480484884063713588522",
"215849832418503707652359889082680897269",
"7752938268164877785913935627307285183",
"209112218049446252346789343052649823652"
],
"threshold": 0.9
}
}
]