U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. Vulnerabilities

CVE-2025-23156 Detail

Description

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi_parser: refactor hfi packet parsing logic words_count denotes the number of words in total payload, while data points to payload of various property within it. When words_count reaches last word, data can access memory beyond the total payload. This can lead to OOB access. With this patch, the utility api for handling individual properties now returns the size of data consumed. Accordingly remaining bytes are calculated before parsing the payload, thereby eliminates the OOB access possibilities.


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
https://git.kernel.org/stable/c/05b07e52a0d08239147ba3460045855f4fb398de kernel.org Patch 
https://git.kernel.org/stable/c/0beabe9b49190a02321b02792b29fc0f0e28b51f kernel.org Patch 
https://git.kernel.org/stable/c/0f9a4bab7d83738963365372e4745854938eab2d kernel.org Patch 
https://git.kernel.org/stable/c/6d278c5548d840c4d85d445347b2a5c31b2ab3a0 kernel.org Patch 
https://git.kernel.org/stable/c/9edaaa8e3e15aab1ca413ab50556de1975bcb329 kernel.org Patch 
https://git.kernel.org/stable/c/a736c72d476d1c7ca7be5018f2614ee61168ad01 kernel.org Patch 
https://git.kernel.org/stable/c/bb3fd8b7906a12dc2b61389abb742bf6542d97fb kernel.org Patch 
https://git.kernel.org/stable/c/f195e94c7af921d99abd79f57026a218d191d2c7 kernel.org Patch 
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html CVE Mailing List 
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html CVE Mailing List 

Weakness Enumeration

CWE-ID CWE Name Source
CWE-125 Out-of-bounds Read cwe source acceptance level NIST  

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

4 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2025-23156
NVD Published Date:
05/01/2025
NVD Last Modified:
11/05/2025
Source:
kernel.org