In the Linux kernel, the following vulnerability has been resolved:
media: venus: hfi_parser: refactor hfi packet parsing logic
wordscount denotes the number of words in total payload, while data points to payload of various property within it. When wordscount reaches last word, data can access memory beyond the total payload. This can lead to OOB access. With this patch, the utility api for handling individual properties now returns the size of data consumed. Accordingly remaining bytes are calculated before parsing the payload, thereby eliminates the OOB access possibilities.
[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 451.0,
"function_hash": "113429176845443404256895024366585767842"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f9a4bab7d83738963365372e4745854938eab2d",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_parser.c",
"function": "parse_profile_level"
},
"id": "CVE-2025-23156-2ac8b0eb"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1394.0,
"function_hash": "35651827604115771607798640660461169260"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f9a4bab7d83738963365372e4745854938eab2d",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_parser.c",
"function": "hfi_parser"
},
"id": "CVE-2025-23156-60e01180"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 149.0,
"function_hash": "330082798772102951962179808156044288393"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f9a4bab7d83738963365372e4745854938eab2d",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_parser.c",
"function": "parse_max_sessions"
},
"id": "CVE-2025-23156-65e07d3e"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 337.0,
"function_hash": "213998807282416778564974834762022416026"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f9a4bab7d83738963365372e4745854938eab2d",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_parser.c",
"function": "parse_codecs"
},
"id": "CVE-2025-23156-72f4ff24"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 435.0,
"function_hash": "198368567149718545586111249004546621229"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f9a4bab7d83738963365372e4745854938eab2d",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_parser.c",
"function": "parse_alloc_mode"
},
"id": "CVE-2025-23156-7e18d45d"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 413.0,
"function_hash": "230700784903330753576270244271145839687"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f9a4bab7d83738963365372e4745854938eab2d",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_parser.c",
"function": "parse_caps"
},
"id": "CVE-2025-23156-87c21232"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 685.0,
"function_hash": "66039859477039730997376310420530026284"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f9a4bab7d83738963365372e4745854938eab2d",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_parser.c",
"function": "parse_raw_formats"
},
"id": "CVE-2025-23156-bdaf9484"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 155.0,
"function_hash": "133388404212045914205190976063352128800"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f9a4bab7d83738963365372e4745854938eab2d",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_parser.c",
"function": "parse_codecs_mask"
},
"id": "CVE-2025-23156-cf8778ff"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"249295092446128419278120875987918531461",
"339352479570698276719930291619990349625",
"265389155777415725227950009573017713633",
"172730151309755427724897534395541565389",
"50397456726275808304441165166002169111",
"125769530040225234219531742621981149639",
"109993276321523606794917984558116455940",
"155694598704574569061414618635722103145",
"311787170098514507521231350142897575373",
"271571895403568121415609241962398979350",
"62254037099713871978566368712114313528",
"104859938252593185116353496512640677634",
"251225958835143743322496990939592264647",
"95406363453812707190409543473766536582",
"67534463895901678638788457534759324283",
"177237572224419283428854660565518887137",
"219564698222136274598686343832986908234",
"170589079381632667876308053518664985008",
"157239825064857914607312775027284976162",
"16823432970116617408238535003573986865",
"231902918240077534903773558684022156373",
"3479743173174577971821122145333229126",
"192476235254893524041252999112840094699",
"142274006313915036553851642065541957457",
"127844305943847015929397781653046695725",
"42113361740402193170545853632939734045",
"99883918964751469816917735632748396535",
"183029851850484308792225556841774158454",
"257004812982364750140494250938705724539",
"170136254409584295718579637868157692605",
"188326336642213262425155264113037647680",
"74483829165067240798763305616171825121",
"246069932941270047782786676727481094653",
"66475973088560354531596131834056977327",
"291246306364592623525904623072421692831",
"18249101105849409786907696832387002587",
"84598554447174276197168287309935443874",
"57496602099833247729513959859748729143",
"169667523887516686288183964912748804847",
"174132440263416831236647529307561717668",
"27747987687104167499052020460601629451",
"338887260706602285040161983749636582665",
"194401804555255510492050650767099797793",
"201337735912498483451380600041987992030",
"260205360240896755215653913863687086442",
"317142653213679715186525511854821256612",
"128956563650160562802407996027051944467",
"20785400683964179293131998260105967768",
"279867923507827097445898378283626116217",
"207740048451743295526501803569995044537",
"30579770781689615064310511114246557294",
"39568138395447320078602290044753255031",
"104071981088141204289197895221277402277",
"228278041101950597905330641908904869644",
"330904613152587036948637400870352304280",
"12389328488795345160434132411167965426",
"130808212464457129078884155031946504056",
"198965443630089946068351154062171123506",
"190818772537409435116770059782792538265",
"157277770655295467085554870895547696123",
"200528421765017026731375974089659830201",
"200224669775009948519470477229262269350",
"1747294806121902784336855781032325105",
"46606551627633159354343139792586146443",
"290476660771938169159508440233409957238",
"19044447618849785317910824347361981125",
"312929579492875644352077238465211311781",
"170245532882155463503662084530558301134",
"171761558734971189253772258036431493119",
"291352742985779126459564871128602208391",
"67384762615333872610673747426481820306",
"203402154201966810771175211712874773265",
"227625397374770332364857673165409513642",
"335282629921530949158759142699931292515",
"6723688429887961504601473682334943861",
"76390928747094323742486385669048346848",
"139632666570217361167410825021738949209",
"189873849105999303685122201834789021662",
"233981121121888597324684886184790655860",
"31998715238618644352291290601373746158",
"92560188733883858986379105694542528310",
"53356672592177299259314796966879065177",
"266974539845216616022713294793633487040",
"158023575776909664380288036725822849546",
"296810132488468066833479441057794571309",
"86900609523478177427337009845185544337",
"81879700802358577079725948354672679029",
"55606238834171655980149851295036921384",
"271166524141012183435967278234995272235",
"46800250495680792111757650367305995641",
"135295635828679724661383129608588069839",
"208785626943005713703743265572581466119",
"154931723364991346129089169067660970786",
"225131834582043372548556854413038499188",
"119815679442986079037635616934762683677",
"113417186897991883473369475410356107398",
"196523197981077672568278273998456747401",
"329358879651973005017534649525159390925",
"278656473742278780124322067223670480692",
"273044645211350846033584871890401335473",
"105028192061844262385957753320972434685",
"285760414022932166425955705471346691354",
"203616214706451787915185283366406961602",
"50530375381558582805805797567438826421",
"335780107835627840102617527233991877325"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f9a4bab7d83738963365372e4745854938eab2d",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_parser.c"
},
"id": "CVE-2025-23156-e185b821"
}
]