CVE-2025-38680

media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()

State: Published
Severity: Not scored
Published: Sep 4, 2025
Updated: May 12, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()

The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes.

This can lead to an out-of-bounds read if the buffer has exactly 3 bytes.

Fix it by checking that the buffer has at least 4 bytes in uvc_parse_format().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c0efd232929c2cd87238de2cccdaf4e845be5b0c to before 9ad554217c9b945031c73df4e8176a475e2dea57Affected c0efd232929c2cd87238de2cccdaf4e845be5b0c to before 1e269581b3aa5962fdc52757ab40da286168c087Affected c0efd232929c2cd87238de2cccdaf4e845be5b0c to before 8343f3fe0b755925f83d60b05e92bf4396879758Affected c0efd232929c2cd87238de2cccdaf4e845be5b0c to before ffdd82182953df643aa63d999b6f1653d0c93778Affected c0efd232929c2cd87238de2cccdaf4e845be5b0c to before a97e062e4ff3dab84a2f1eb811e9eddc6699e2a9Affected c0efd232929c2cd87238de2cccdaf4e845be5b0c to before cac702a439050df65272c49184aef7975fe3eff2Affected c0efd232929c2cd87238de2cccdaf4e845be5b0c to before 424980d33b3f816485513e538610168b03fab9f1Affected c0efd232929c2cd87238de2cccdaf4e845be5b0c to before 6d4a7c0b296162354b6fc759a1475b9d57ddfaa6Affected c0efd232929c2cd87238de2cccdaf4e845be5b0c to before 782b6a718651eda3478b1824b37a8b3185d2740cAffected
LinuxLinux	2.6.26Affected before 2.6.26Not affected 5.4.297 through 5.4.Not affected 5.10.241 through 5.10.Not affected 5.15.190 through 5.15.Not affected 6.1.149 through 6.1.Not affected 6.6.103 through 6.6.Not affected 6.12.43 through 6.12.Not affected 6.15.11 through 6.15.Not affected 6.16.2 through 6.16.Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

c0efd232929c2cd87238de2cccdaf4e845be5b0c to before 9ad554217c9b945031c73df4e8176a475e2dea57Affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to before 1e269581b3aa5962fdc52757ab40da286168c087Affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to before 8343f3fe0b755925f83d60b05e92bf4396879758Affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to before ffdd82182953df643aa63d999b6f1653d0c93778Affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to before a97e062e4ff3dab84a2f1eb811e9eddc6699e2a9Affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to before cac702a439050df65272c49184aef7975fe3eff2Affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to before 424980d33b3f816485513e538610168b03fab9f1Affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to before 6d4a7c0b296162354b6fc759a1475b9d57ddfaa6Affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to before 782b6a718651eda3478b1824b37a8b3185d2740cAffected

LinuxLinux

2.6.26Affected
before 2.6.26Not affected
5.4.297 through 5.4.*Not affected
5.10.241 through 5.10.*Not affected
5.15.190 through 5.15.*Not affected
6.1.149 through 6.1.*Not affected
6.6.103 through 6.6.*Not affected
6.12.43 through 6.12.*Not affected
6.15.11 through 6.15.*Not affected
6.16.2 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.