HighFix available
media: venus: hfi: add a check to handle OOB in sfr region
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.237, 5.15.181, 5.4.293, 6.1.135, 6.12.24, 6.13.12, 6.14.3, 6.6.88
- CVEs
- CVE-2025-23159
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 02:07 UTC · Revision 1
Source evidence
media: venus: hfi: add a check to handle OOB in sfr region
core-osv · Original sourcePublished 1 May 2025, 12:55 UTC
In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases.
osv:CVE-2025-23159
Kernel
Fixed versions: 5.4.293, 5.10.237, 5.15.181, 6.1.135, 6.6.88, 6.12.24, 6.13.12, 6.14.3
Complete source record
{
"id": "23a083922d9e3931b280b394f7945d280447313c6cb7fb9b05514ab546b22d46",
"url": "https://osv.dev/vulnerability/CVE-2025-23159",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "media: venus: hfi: add a check to handle OOB in sfr region",
"summary": "In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases.",
"evidence": "osv:CVE-2025-23159",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.4.293",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.237",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.181",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.135",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.88",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.24",
"evidence": "/affected/1/ranges"
},
{
"value": "6.13.12",
"evidence": "/affected/1/ranges"
},
{
"value": "6.14.3",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2025-23159",
"aliases": [
"CVE-2025-23159"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "d96d3f30c0f2f564f6922bf4ccdf4464992e31fb"
},
{
"fixed": "4dd109038d513b92d4d33524ffc89ba32e02ba48"
},
{
"fixed": "8879397c0da5e5ec1515262995e82cdfd61b282a"
},
{
"fixed": "1b8fb257234e7d2d4b3f48af07c5aa5e11c71634"
},
{
"fixed": "4e95233af57715d81830fe82b408c633edff59f4"
},
{
"fixed": "5af611c70fb889d46d2f654b8996746e59556750"
},
{
"fixed": "530f623f56a6680792499a8404083e17f8ec51f4"
},
{
"fixed": "a062d8de0be5525ec8c52f070acf7607ec8cbfe4"
},
{
"fixed": "d78a8388a27b265fcb2b8d064f088168ac9356b0"
},
{
"fixed": "f4b211714bcc70effa60c34d9fa613d182e3ef1e"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-23159.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.13.0"
},
{
"fixed": "5.4.293"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.237"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.181"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.135"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.88"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.24"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.13.12"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.14.0"
},
{
"fixed": "6.14.3"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-23159.json"
}
}
],
"modified": "2026-10-28T02:30:25.157961630Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/1b8fb257234e7d2d4b3f48af07c5aa5e11c71634",
"https://git.kernel.org/stable/c/4dd109038d513b92d4d33524ffc89ba32e02ba48",
"https://git.kernel.org/stable/c/4e95233af57715d81830fe82b408c633edff59f4",
"https://git.kernel.org/stable/c/530f623f56a6680792499a8404083e17f8ec51f4",
"https://git.kernel.org/stable/c/5af611c70fb889d46d2f654b8996746e59556750",
"https://git.kernel.org/stable/c/8879397c0da5e5ec1515262995e82cdfd61b282a",
"https://git.kernel.org/stable/c/a062d8de0be5525ec8c52f070acf7607ec8cbfe4",
"https://git.kernel.org/stable/c/d78a8388a27b265fcb2b8d064f088168ac9356b0",
"https://git.kernel.org/stable/c/f4b211714bcc70effa60c34d9fa613d182e3ef1e",
"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html",
"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23159.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-23159",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23159.json"
}
},
"related_cves": [
{
"value": "CVE-2025-23159",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 491789,
"published_at": "2025-05-01T12:55:44.695+00:00"
}