In the Linux kernel, the following vulnerability has been resolved:
media: venus: hfi: add a check to handle OOB in sfr region
sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 330.0,
"function_hash": "46597538136494794550796917301801764582"
},
"id": "CVE-2025-23159-36ce03f5",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@530f623f56a6680792499a8404083e17f8ec51f4",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c",
"function": "venus_sfr_print"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 330.0,
"function_hash": "46597538136494794550796917301801764582"
},
"id": "CVE-2025-23159-51677520",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4b211714bcc70effa60c34d9fa613d182e3ef1e",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c",
"function": "venus_sfr_print"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"144873396634831887328319399899731061647",
"10224187006829307026134464460787617909",
"60898897612572219440654361704661853738",
"223346493305345413306618884594845245600",
"267108509187701432824343059619434882667",
"231852860068490042065741349040832635254",
"301687667655994580480484884063713588522",
"215849832418503707652359889082680897269",
"7752938268164877785913935627307285183",
"209112218049446252346789343052649823652"
]
},
"id": "CVE-2025-23159-6ef0ac1e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4b211714bcc70effa60c34d9fa613d182e3ef1e",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"144873396634831887328319399899731061647",
"10224187006829307026134464460787617909",
"60898897612572219440654361704661853738",
"223346493305345413306618884594845245600",
"267108509187701432824343059619434882667",
"231852860068490042065741349040832635254",
"301687667655994580480484884063713588522",
"215849832418503707652359889082680897269",
"7752938268164877785913935627307285183",
"209112218049446252346789343052649823652"
]
},
"id": "CVE-2025-23159-b0f141c9",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e95233af57715d81830fe82b408c633edff59f4",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 330.0,
"function_hash": "46597538136494794550796917301801764582"
},
"id": "CVE-2025-23159-c2ecf94e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e95233af57715d81830fe82b408c633edff59f4",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c",
"function": "venus_sfr_print"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"144873396634831887328319399899731061647",
"10224187006829307026134464460787617909",
"60898897612572219440654361704661853738",
"223346493305345413306618884594845245600",
"267108509187701432824343059619434882667",
"231852860068490042065741349040832635254",
"301687667655994580480484884063713588522",
"215849832418503707652359889082680897269",
"7752938268164877785913935627307285183",
"209112218049446252346789343052649823652"
]
},
"id": "CVE-2025-23159-fff2fd17",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@530f623f56a6680792499a8404083e17f8ec51f4",
"target": {
"file": "drivers/media/platform/qcom/venus/hfi_venus.c"
}
}
]