CVE-2025-38680

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-38680
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38680.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38680
Downstream
Related
Published
2025-09-04T15:32:35.963Z
Modified
2026-05-18T05:58:07.167208233Z
Summary
media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
Details

In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Fix 1-byte out-of-bounds read in uvcparseformat()

The buffer length check before calling uvcparseformat() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes.

This can lead to an out-of-bounds read if the buffer has exactly 3 bytes.

Fix it by checking that the buffer has at least 4 bytes in uvcparseformat().

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38680.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c0efd232929c2cd87238de2cccdaf4e845be5b0c
Fixed
9ad554217c9b945031c73df4e8176a475e2dea57
Fixed
1e269581b3aa5962fdc52757ab40da286168c087
Fixed
8343f3fe0b755925f83d60b05e92bf4396879758
Fixed
ffdd82182953df643aa63d999b6f1653d0c93778
Fixed
a97e062e4ff3dab84a2f1eb811e9eddc6699e2a9
Fixed
cac702a439050df65272c49184aef7975fe3eff2
Fixed
424980d33b3f816485513e538610168b03fab9f1
Fixed
6d4a7c0b296162354b6fc759a1475b9d57ddfaa6
Fixed
782b6a718651eda3478b1824b37a8b3185d2740c

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38680.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.26
Fixed
5.4.297
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.241
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.190
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.149
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.103
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.43
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.15.11
Type
ECOSYSTEM
Events
Introduced
6.16.0
Fixed
6.16.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38680.json"