Buffer Overrun in LZO Compression of Linux Kernel

CVE-2025-38068

What is CVE-2025-38068?

A vulnerability has been identified in the Linux kernel's LZO compression implementation, where the compression code does not validate output buffer sizes, leading to potential buffer overrun issues. In contrast to its decompression counterpart, the compression mechanism wrongly assumes that adequate buffer space is always supplied by the caller. To address this flaw, a new secure compression interface has been introduced, which incorporates checks for buffer limits before writing outputs, significantly enhancing the safety and reliability of the compression process.

References