CVE-2025-38680

What it actually does

Out-of-bounds read in uvc_parse_format() because a length check only guarantees three bytes but the code indexes buffer[3], enabling a one-byte read past the end of a supplied buffer.

Why it matters to the business

Systems handling USB video devices on affected Linux kernels risk memory disclosure or crashes; widespread use in containers and embedded deployments increases exposure, with remediation deadlines and downstream package counts amplifying urgency for organizations running MinimOS or similar environments.

How an attack unfolds

An attacker with local access supplies a USB video class descriptor that is exactly three bytes long to the uvcvideo driver; the missing length check allows uvc_parse_format() to read one byte beyond the buffer, disclosing adjacent kernel memory or triggering faults. Related threat actors have demonstrated similar kernel memory corruption techniques on container-optimized OSes.

How to fix it

Upgrade affected packages to the listed fixed versions: kyverno-1.14 and related MinimOS components to 1.14.4-r2; Linux kernel to commit 9ad554217c9b945031c73df4e8176a475e2dea57 or later stable releases containing the buffer-length correction.

How to confirm the fix worked

Verify installed kernel and package versions match or exceed the fixed revisions; confirm the corrected length check (buflen > 3) is present in uvc_parse_format() source or binary.

Typical attack path

1. Obtain local access or the ability to attach USB devices
2. Present a crafted UVC descriptor containing exactly three bytes
3. Trigger format parsing in the uvcvideo driver
4. Read one byte past the allocated buffer

How to detect it

Review kernel logs for uvcvideo or uvc_parse_format faults; examine USB descriptor parsing paths for short buffers; correlate with process activity involving video4linux or UVC devices. Related threat actor campaigns on container OSes have used similar kernel flaws for privilege escalation.

What your security team should do

• Apply the listed fixed versions immediately given the 418 days since publication and container ecosystem prevalence
• Restrict untrusted USB device attachment until patches are deployed
• Monitor for kernel oops or uvcvideo-related crashes as indicators of attempted exploitation