CVE-2025-38679

What it actually does

The vulnerability allows an out-of-bounds read in the Linux kernel's Venus media driver when parsing event properties from firmware without validating the payload size against the reported property count, leading to access beyond allocated buffers.

Why it matters to the business

Systems running affected Linux kernel versions with Venus hardware may experience crashes or leaks of kernel memory, potentially impacting stability and confidentiality in media processing workloads. With 418 days since publication and no known exploitation in KEV, prioritize patching in high-risk environments.

How an attack unfolds

An attacker with the ability to influence or emulate the Venus firmware sends a message indicating more properties than the actual payload contains, causing the event_seq_changed handler to read beyond the message buffer during iteration.

How to fix it

Update the Linux kernel to the fixed commit a3eef5847603cd8a4110587907988c3f93c9605a or later versions that include proper payload bound checks before parsing properties.

How to confirm the fix worked

Verify the kernel source includes the bounds check in event_seq_changed() and test with malformed firmware messages to ensure no OOB access occurs.

Typical attack path

1. Compromise or control the firmware interface
2. Craft a malformed event message with inflated property count
3. Trigger event_seq_changed() processing
4. Induce OOB read leading to crash or leak

How to detect it

Look for kernel logs indicating out-of-bounds access or crashes in the venus driver; monitor for unexpected firmware events.

What your security team should do

• Apply the kernel patch immediately on affected systems
• Monitor for kernel oops or panics related to venus driver
• Restrict access to media firmware interfaces where possible