Executive brief
A vulnerability in the Linux kernel's video handling component could allow a local user to cause system instability or potentially gain unauthorized access to data. The issue occurs when the system attempts to remove video buffers while a legacy file input/output mode is active, leading to corrupted internal memory pointers. This could result in a system crash or allow an attacker to manipulate sensitive kernel memory.
Technical details
A race condition or state inconsistency exists in the Linux kernel's videobuf2 (vb2) framework. The vb2_ioctl_remove_bufs() function manipulates the internal buffer list of a queue without checking if legacy fileio access mode is currently active. If invoked during active fileio, the ioctl can overwrite pointers used by read/write operations, leading to memory corruption or use-after-free scenarios. The vulnerability is reachable via local ioctl calls to media devices. Patches have been released for various stable branches (e.g., 6.12.58, 6.17.8) to forbid this ioctl when fileio is active.
Affected products
- Linux Linux Kernel 6.10 to 6.17.7
Timeline
- 2025-10-23: patched: Initial fix authored by Marek Szyprowski
- 2025-12-08: disclosed: CVE published