CVE-2025-38226 Overview
CVE-2025-38226 is an out-of-bounds write vulnerability in the Linux kernel's vivid virtual video test driver. The flaw resides in the Video4Linux2 Test Pattern Generator (V4L2-TPG) subsystem, specifically in tpg_fill_plane_pattern and tpg_fill_plane_buffer in drivers/media/common/v4l2-tpg/v4l2-tpg-core.c. Syzkaller identified a KASAN vmalloc-out-of-bounds write of 1440 bytes when the compose rectangle exceeds the size of fmt_cap_rect. The fix enforces v4l2_rect_map_inside() even when has_compose_cap == 0, constraining the composition size. The issue affects the mainline Linux kernel and Debian Linux 11.
Critical Impact
A local user with access to the vivid device can trigger a kernel out-of-bounds write, leading to memory corruption, denial of service, or potential local privilege escalation.
Affected Products
- Linux kernel (multiple stable branches prior to the fix commits)
- Debian Linux 11
- Systems loading the vivid V4L2 test driver module
Discovery Timeline
- 2025-07-04 - CVE-2025-38226 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2025-38226
Vulnerability Analysis
The vulnerability is an out-of-bounds write [CWE-787] in the vivid driver, which emulates video capture, output, and radio devices for V4L2 testing. When userspace configures a compose rectangle through the V4L2 selection API, the driver fails to clamp the compose size against the capture format rectangle (fmt_cap_rect) when has_compose_cap is zero.
The test pattern generator uses the compose dimensions to compute memcpy sizes into the plane buffer. When compose dimensions exceed the underlying buffer, tpg_fill_plane_pattern writes past the allocation. The syzkaller report demonstrates a 1440-byte write outside a vmalloc region, detected by KASAN in __asan_memcpy within tpg_fill_plane_buffer.
Root Cause
The root cause is missing bounds enforcement between the user-controllable compose rectangle and the capture format rectangle. The original code path skipped v4l2_rect_map_inside() when the device did not advertise compose capability, leaving the compose size unclamped. Any values larger than fmt_cap_rect propagate into the buffer-filling routine, producing writes past the allocated plane buffer.
Attack Vector
Exploitation requires local access and the ability to open the vivid character device, typically /dev/video*. An attacker issues VIDIOC_S_SELECTION ioctl calls to set a compose rectangle larger than the current capture format. When the vivid kthread vivid-000-vid-c fills the next frame, tpg_fill_plane_buffer overwrites adjacent vmalloc memory. Because the write is attacker-influenced in size and content pattern, this creates a path to kernel memory corruption impacting confidentiality, integrity, and availability.
No verified public proof-of-concept code is available beyond the syzkaller reproducer referenced in the kernel commit messages. See the Linux kernel fix commit for the corrective patch.
Detection Methods for CVE-2025-38226
Indicators of Compromise
- Kernel log entries containing KASAN: vmalloc-out-of-bounds referencing tpg_fill_plane_pattern or tpg_fill_plane_buffer.
- Unexpected kernel oops, panic, or task stalls originating from the vivid-*-vid-c kthread.
- Loading of the vivid kernel module on production hosts where video test infrastructure is not required.
Detection Strategies
- Audit loaded kernel modules with lsmod | grep vivid and alert on presence outside test environments.
- Monitor dmesg and /var/log/kern.log for KASAN reports, general protection faults, or slab corruption traces in V4L2 code paths.
- Track ioctl activity against /dev/video* nodes from non-privileged processes using auditd rules on openat and ioctl syscalls.
Monitoring Recommendations
- Ingest kernel logs into a centralized log platform and alert on KASAN, BUG, and Oops signatures referencing v4l2-tpg-core.c.
- Baseline which users and services legitimately access /dev/video* devices and flag deviations.
- Correlate unexpected module loads (init_module, finit_module) with subsequent V4L2 ioctl bursts to detect exploitation attempts.
How to Mitigate CVE-2025-38226
Immediate Actions Required
- Apply the vendor kernel update that includes commit 635cea4f44c1ddae208666772c164eab5a6bce39 or any of the backport commits listed in the kernel.org stable tree.
- On Debian systems, install the kernel packages referenced in the Debian LTS Announcement and the second Debian LTS Announcement.
- Restrict access to /dev/video* devices to trusted users and groups.
Patch Information
The fix ensures v4l2_rect_map_inside() is called unconditionally so the compose rectangle cannot exceed fmt_cap_rect. Backports are available in the kernel stable branches via commits 00da1c76, 57597d8d, 5d89aa42, 635cea4f, 89b5ab82, c5639888, f6b1b0f8, and f83ac8d3. Refer to the Linux kernel stable tree for the authoritative patch set.
Workarounds
- Blacklist the vivid module on production systems using /etc/modprobe.d/blacklist-vivid.conf with blacklist vivid and install vivid /bin/true.
- Unload the module immediately with modprobe -r vivid where it is currently loaded and not required.
- Restrict permissions on /dev/video* nodes so only privileged administrators can issue V4L2 ioctls until patching is complete.
# Configuration example
echo 'blacklist vivid' | sudo tee /etc/modprobe.d/blacklist-vivid.conf
echo 'install vivid /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-vivid.conf
sudo modprobe -r vivid 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
