Buffer Manipulation Vulnerability in Linux Kernel Affecting Media Components

CVE-2025-40302

What is CVE-2025-40302?

A vulnerability in the Linux kernel affects the media subsystem, specifically involving the videobuf2 component. The issue arises from the vb2_ioctl_remove_bufs() call, which can manipulate the internal buffer list. This manipulation can potentially overwrite pointers that are crucial for managing the legacy fileio access mode. To protect the integrity of the queue state during subsequent read and write operations, this ioctl operation is forbidden when fileio is active. Implementing this restriction is vital to maintaining security within the kernel's media operations.

References