Executive brief
A security vulnerability exists in the Linux kernel's camera driver for certain Intel-based tablets and laptops. This flaw allows a local user or malicious software to trigger a memory overflow by providing oversized configuration data during device startup. If exploited, this could lead to a complete system crash or allow an attacker to gain unauthorized control over the operating system.
Technical details
A stack-based buffer overflow exists in the atomisp camera driver within the Linux kernel's staging directory. The vulnerability is caused by a logic error in 'gmin_get_config_var()' where it fails to return an error code when 'efi.get_variable()' returns 'EFI_BUFFER_TOO_SMALL'. Consequently, the caller 'gmin_get_var_int()' incorrectly assumes the operation succeeded and uses the returned 'required_size' to perform a null-termination write ('val[len] = 0') on a fixed-size 65-byte stack buffer. An attacker with the ability to influence EFI variables could exploit this to achieve arbitrary code execution or cause a kernel panic. The issue affects Intel Bay Trail and Cherry Trail platforms and has been addressed in multiple stable kernel branches.
Affected products
- Linux Linux Kernel 6.0 to 6.12.42, 6.13 to 6.15.10, 6.16 to 6.16.1
Timeline
- 2025-07-24: disclosed: Vulnerability reported and patch submitted by Kees Cook
- 2025-08-15: patched: Patches committed to stable kernel trees
- 2025-08-19: advisory: CVE-2025-38585 published
References
- https://git.kernel.org/stable/c/1a7a2f59fb2eb0718a0cff1e5822500cefe50ed9
- https://git.kernel.org/stable/c/3d672fe065aa00f4d66f42e3c9720f69a3ed43e7
- https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654
- https://git.kernel.org/stable/c/e6d3453a002e89537e6136f6c774659b297a549b
- https://git.kernel.org/stable/c/ee4cf798202d285dcbe85e4467a094c44f5ed8e6