CVE-2025-40302

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40302", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.185Z", "datePublished": "2025-12-08T00:46:26.293Z", "dateUpdated": "2026-10-15T22:02:43.093Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:09:21.585Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: videobuf2: forbid remove_bufs when legacy fileio is active\n\nvb2_ioctl_remove_bufs() call manipulates queue internal buffer list,\npotentially overwriting some pointers used by the legacy fileio access\nmode. Forbid that ioctl when fileio is active to protect internal queue\nstate between subsequent read/write calls."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires opening a V4L2 device node (/dev/videoN) and issuing read()/write() plus the VIDIOC_REMOVE_BUFS ioctl from a local process. There is no network-reachable path into videobuf2's legacy fileio emulator.\nAC:L - The attack is a purely sequential, deterministic three-step sequence on a single file descriptor (read/write \u2192 REMOVE_BUFS \u2192 read/write) with no race window; the same fd owns the queue so vb2_queue_is_busy() never blocks it. No special memory layout or timing beyond attacker control is required.\nPR:L - Any local unprivileged user with access to the video device node can trigger this \u2014 desktop distros grant the active session user access via logind uaccess ACLs/the video group, and Android/embedded camera sandboxes expose these nodes directly. No CAP_SYS_ADMIN or other capability is checked on the ioctl path.\nUI:N - The attacking process performs every step itself on its own file descriptor; no victim action, mount, or plug-in event is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - After the buffers are freed, __vb2_perform_fileio() still does copy_to_user(data, buf->vaddr + buf->pos, count) using the stale cached kernel address, disclosing up to a full frame (potentially megabytes) of freed kernel memory \u2014 reusable by kernel stacks, slab objects, or page tables \u2014 directly to userspace.\nI:H - On output/write queues the same stale pointer is used in copy_from_user(buf->vaddr + buf->pos, data, count), giving an attacker-controlled write of arbitrary length into freed kernel memory (vfree'd vmalloc region reusable by VMAP kernel stacks, or page-allocator pages with dma-contig), a classic UAF write primitive for privilege escalation; a NULL-pointer write via b->planes[0].bytesused also occurs.\nA:H - vb2_get_buffer() returns NULL for the removed index despite the code asserting it \"can never be NULL when using fileio\", producing a NULL-pointer dereference oops, and the use-after-free of vfree'd vmalloc addresses causes unrecoverable kernel faults."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/common/videobuf2/videobuf2-v4l2.c"], "versions": [{"version": "a3293a85381ec9680aa2929547fbc76c5d87a1b2", "lessThan": "a6a493b985bfffac097a4e1be09f98b27729dca8", "status": "affected", "versionType": "git"}, {"version": "a3293a85381ec9680aa2929547fbc76c5d87a1b2", "lessThan": "e819b34df0a7030a15c968d619fa8a3ed2455c7a", "status": "affected", "versionType": "git"}, {"version": "a3293a85381ec9680aa2929547fbc76c5d87a1b2", "lessThan": "27afd6e066cfd80ddbe22a4a11b99174ac89cced", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/common/videobuf2/videobuf2-v4l2.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.58", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.58"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.17.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a6a493b985bfffac097a4e1be09f98b27729dca8"}, {"url": "https://git.kernel.org/stable/c/e819b34df0a7030a15c968d619fa8a3ed2455c7a"}, {"url": "https://git.kernel.org/stable/c/27afd6e066cfd80ddbe22a4a11b99174ac89cced"}], "title": "media: videobuf2: forbid remove_bufs when legacy fileio is active", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40302", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:58:57.256388Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:43.093Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40302", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:58:57.256388Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:58:58.175Z"}}], "cna": {"title": "media: videobuf2: forbid remove_bufs when legacy fileio is active", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires opening a V4L2 device node (/dev/videoN) and issuing read()/write() plus the VIDIOC_REMOVE_BUFS ioctl from a local process. There is no network-reachable path into videobuf2's legacy fileio emulator.\nAC:L - The attack is a purely sequential, deterministic three-step sequence on a single file descriptor (read/write \u2192 REMOVE_BUFS \u2192 read/write) with no race window; the same fd owns the queue so vb2_queue_is_busy() never blocks it. No special memory layout or timing beyond attacker control is required.\nPR:L - Any local unprivileged user with access to the video device node can trigger this \u2014 desktop distros grant the active session user access via logind uaccess ACLs/the video group, and Android/embedded camera sandboxes expose these nodes directly. No CAP_SYS_ADMIN or other capability is checked on the ioctl path.\nUI:N - The attacking process performs every step itself on its own file descriptor; no victim action, mount, or plug-in event is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - After the buffers are freed, __vb2_perform_fileio() still does copy_to_user(data, buf->vaddr + buf->pos, count) using the stale cached kernel address, disclosing up to a full frame (potentially megabytes) of freed kernel memory \u2014 reusable by kernel stacks, slab objects, or page tables \u2014 directly to userspace.\nI:H - On output/write queues the same stale pointer is used in copy_from_user(buf->vaddr + buf->pos, data, count), giving an attacker-controlled write of arbitrary length into freed kernel memory (vfree'd vmalloc region reusable by VMAP kernel stacks, or page-allocator pages with dma-contig), a classic UAF write primitive for privilege escalation; a NULL-pointer write via b->planes[0].bytesused also occurs.\nA:H - vb2_get_buffer() returns NULL for the removed index despite the code asserting it \"can never be NULL when using fileio\", producing a NULL-pointer dereference oops, and the use-after-free of vfree'd vmalloc addresses causes unrecoverable kernel faults."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a3293a85381ec9680aa2929547fbc76c5d87a1b2", "lessThan": "a6a493b985bfffac097a4e1be09f98b27729dca8", "versionType": "git"}, {"status": "affected", "version": "a3293a85381ec9680aa2929547fbc76c5d87a1b2", "lessThan": "e819b34df0a7030a15c968d619fa8a3ed2455c7a", "versionType": "git"}, {"status": "affected", "version": "a3293a85381ec9680aa2929547fbc76c5d87a1b2", "lessThan": "27afd6e066cfd80ddbe22a4a11b99174ac89cced", "versionType": "git"}], "programFiles": ["drivers/media/common/videobuf2/videobuf2-v4l2.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"status": "unaffected", "version": "0", "lessThan": "6.10", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.58", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.8", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/media/common/videobuf2/videobuf2-v4l2.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/a6a493b985bfffac097a4e1be09f98b27729dca8"}, {"url": "https://git.kernel.org/stable/c/e819b34df0a7030a15c968d619fa8a3ed2455c7a"}, {"url": "https://git.kernel.org/stable/c/27afd6e066cfd80ddbe22a4a11b99174ac89cced"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: videobuf2: forbid remove_bufs when legacy fileio is active\n\nvb2_ioctl_remove_bufs() call manipulates queue internal buffer list,\npotentially overwriting some pointers used by the legacy fileio access\nmode. Forbid that ioctl when fileio is active to protect internal queue\nstate between subsequent read/write calls."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.58", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.8", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "6.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:09:21.585Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40302", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:43.093Z", "dateReserved": "2025-04-16T07:20:57.185Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-08T00:46:26.293Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/common/videobuf2/videobuf2-v4l2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a6a493b985bfffac097a4e1be09f98b27729dca8", "status": "affected", "version": "a3293a85381ec9680aa2929547fbc76c5d87a1b2", "versionType": "git"}, {"lessThan": "e819b34df0a7030a15c968d619fa8a3ed2455c7a", "status": "affected", "version": "a3293a85381ec9680aa2929547fbc76c5d87a1b2", "versionType": "git"}, {"lessThan": "27afd6e066cfd80ddbe22a4a11b99174ac89cced", "status": "affected", "version": "a3293a85381ec9680aa2929547fbc76c5d87a1b2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/common/videobuf2/videobuf2-v4l2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.58", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: videobuf2: forbid remove_bufs when legacy fileio is active\n\nvb2_ioctl_remove_bufs() call manipulates queue internal buffer list,\npotentially overwriting some pointers used by the legacy fileio access\nmode. Forbid that ioctl when fileio is active to protect internal queue\nstate between subsequent read/write calls."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: videobuf2: prohibir remove_bufs cuando el fileio heredado est\u00e1 activo\n\nLa llamada a vb2_ioctl_remove_bufs() manipula la lista interna de b\u00faferes de la cola, sobrescribiendo potencialmente algunos punteros utilizados por el modo de acceso de fileio heredado. Prohibir ese ioctl cuando el fileio est\u00e1 activo para proteger el estado interno de la cola entre llamadas de lectura/escritura subsiguientes."}], "id": "CVE-2025-40302", "lastModified": "2026-10-15T22:19:07.427", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40302", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:58:57.256388Z", "version": "2.0.3"}}]}, "published": "2025-12-08T01:16:02.313", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/27afd6e066cfd80ddbe22a4a11b99174ac89cced"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a6a493b985bfffac097a4e1be09f98b27729dca8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e819b34df0a7030a15c968d619fa8a3ed2455c7a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: media: videobuf2: forbid remove_bufs when legacy fileio is active", "id": "2419907", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419907"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40302", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40302\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40302\nhttps://lore.kernel.org/linux-cve-announce/2025120819-CVE-2025-40302-84e9@gregkh/T"], "threat_severity": "Moderate"}

{}