Skip to main content

Linux Kernel CVE-2025-40302

| EUVDEUVD-2025-201643 HIGH
2025-12-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local device-node access needed (AV:L, PR:L), triggered by a direct ioctl during an attacker-controlled fileio session (AC:L, UI:N); kernel memory corruption supports high C/I/A within the unchanged kernel scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Red Hat
6.3 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch available
Apr 16, 2026 - 05:29 EUVD
27afd6e066cfd80ddbe22a4a11b99174ac89cced
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201643
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
CVE Published
Dec 08, 2025 - 01:16 cve.org
HIGH 7.8
CVE Published
Dec 08, 2025 - 01:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: videobuf2: forbid remove_bufs when legacy fileio is active

vb2_ioctl_remove_bufs() call manipulates queue internal buffer list, potentially overwriting some pointers used by the legacy fileio access mode. Forbid that ioctl when fileio is active to protect internal queue state between subsequent read/write calls.

AnalysisAI

Local privilege escalation via memory corruption in the Linux kernel's videobuf2 (vb2) media framework allows a local user with access to a V4L2 video device to corrupt internal queue state by invoking the VIDIOC_REMOVE_BUFS ioctl while legacy read/write fileio mode is active. The vb2_ioctl_remove_bufs() path manipulates the queue's internal buffer list and can overwrite pointers the fileio access mode still relies on, leading to high-impact confidentiality, integrity, and availability effects (CVSS 7.8, AV:L). No public exploit has been identified at time of analysis; EPSS is negligible (0.03%) and the flaw is not in CISA KEV.

Technical ContextAI

The affected component is videobuf2 (vb2), the Linux kernel's core buffer-management framework for V4L2 media/streaming drivers (cameras, capture cards, codecs) exposed through /dev/videoN device nodes. vb2 supports two mutually-exclusive access models on the same queue: modern streaming with explicit buffer management, and a legacy 'fileio' emulation that lets applications use plain read()/write() by having the kernel implicitly allocate and cycle buffers. The VIDIOC_REMOVE_BUFS ioctl (backed by vb2_ioctl_remove_bufs()) dynamically removes buffers from the queue's internal list. Because that list is the same state fileio uses across successive read/write calls, removing buffers mid-fileio-session can overwrite or invalidate pointers the fileio path dereferences later - a state-confusion / stale-pointer condition (use-after-free / invalid pointer use class; the CWE was not assigned in the source data). The fix simply forbids the remove_bufs ioctl whenever fileio is active, preserving queue invariants.

RemediationAI

Apply the vendor patch by upgrading to a fixed stable kernel: 6.12.58 or later on the 6.12 LTS series, 6.17.8 or later on 6.17, or 6.18, or take your distribution's backported build referencing CVE-2025-40302. The corresponding upstream stable commits are e819b34df0a7030a15c968d619fa8a3ed2455c7a, 27afd6e066cfd80ddbe22a4a11b99174ac89cced, and a6a493b985bfffac097a4e1be09f98b27729dca8 (see the git.kernel.org links above). Where immediate patching is not possible, the practical compensating control is to restrict access to V4L2 device nodes: tighten permissions/ownership on /dev/video* (e.g. remove untrusted accounts from the 'video' group or apply udev rules limiting the nodes to trusted users), which prevents unprivileged local users from reaching the vulnerable ioctl at the cost of breaking legitimate camera/capture access for those users. On container hosts, avoid exposing /dev/video* into untrusted containers, and consider seccomp/LSM policy to block the ioctl path - noting this will disable video functionality for affected workloads.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected

Share

CVE-2025-40302 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy