CVE-2025-38226

What it actually does

Out-of-bounds write via vmalloc due to missing enforcement of composition rectangle bounds against fmt_cap_rect in tpg_fill_plane_pattern and vivid capture thread, allowing oversized writes during plane buffer filling.

Why it matters to the business

Kernel instability, potential crashes, or memory corruption on systems exposing the vivid virtual video driver; high prevalence in testing and development environments increases exposure risk, with listed threat actors indicating active kernel privilege escalation campaigns.

How an attack unfolds

Attacker supplies crafted V4L2 format parameters where composition size exceeds fmt_cap_rect; the vivid capture thread calls tpg_fill_plane_buffer without the required v4l2_rect_map_inside check, resulting in an oversized memcpy that triggers KASAN-detected vmalloc corruption.

How to fix it

Apply the upstream fix ensuring v4l2_rect_map_inside executes regardless of has_compose_cap state; update to a kernel containing commit resolving the vivid composition size validation. For the referenced openssh-portable package, upgrade to 4eb0a532efe679917e07655721145c6882bdb4c7.

How to confirm the fix worked

Confirm presence of the bounds-mapping call in v4l2-tpg-core.c; test with syzkaller-style vivid format configurations that previously triggered the KASAN report; verify no vmalloc-out-of-bounds on affected code paths.

Typical attack path

1. Load or ensure vivid driver is active
2. Issue V4L2 ioctls or format configuration with oversized compose rectangle
3. Trigger vivid_thread_vid_cap_tick to invoke tpg_fill_plane_buffer
4. Perform out-of-bounds write during plane pattern filling

How to detect it

Review kernel logs for KASAN vmalloc-out-of-bounds reports referencing tpg_fill_plane_pattern or vivid-kthread-cap.c; inspect V4L2 format negotiation events and vivid capture thread activity for anomalous rectangle sizes.

What your security team should do

• Prioritize kernel updates on systems exposing test media drivers
• Disable vivid module if not required for operations
• Monitor for related Linux kernel privilege-escalation activity from listed threat actors
• Audit media subsystem usage in CI/test environments given 480 days since publication