Security readout for executives and security teams
Plain-English summary
A flaw in Linux's vivid virtual video test driver can let a low-privileged local user trigger an out-of-bounds kernel write. This may crash the system and could affect confidentiality, integrity, or availability. The issue is rated CVSS 7.8, but the supplied evidence does not establish practical privilege escalation.
Executive priority
Treat this as high priority on shared, development, testing, or media-processing Linux systems where vivid is available to untrusted local users. For systems without the driver or local-user exposure, confirm applicability promptly and remediate through normal accelerated kernel maintenance rather than emergency internet-edge response.
Technical view
The vivid capture path could permit a composition rectangle larger than fmt_cap_rect when composition capability was disabled. During test-pattern generation, this caused a vmalloc out-of-bounds write detected by KASAN. The documented correction applies v4l2_rect_map_inside() regardless of the capability flag, constraining the composition dimensions.
Likely exposure
Exposure requires a vulnerable Linux kernel, the vivid media test driver, and local low-privileged access. This is not described as a remote network vulnerability. The bundle's flattened version data is ambiguous, so distribution package status or inclusion of the referenced fixes should determine exposure.
Exploitation context
Syzkaller triggered the flaw and KASAN confirmed an out-of-bounds write. The CVSS vector indicates local access, low privileges, low complexity, and no user interaction. The CVE is not in KEV, and the supplied sources provide no evidence of active exploitation or a public weaponized exploit.
Researcher notes
No CWE is supplied. The evidence demonstrates a kernel memory-safety violation in the vivid capture thread, but not reliable code execution or privilege escalation. Version interpretation needs vendor confirmation because the bundled affected records mix commit identifiers, releases, and conflicting default-status groupings. Multiple Linux stable commits and Debian LTS notices indicate backported remediation.
Mitigation direction
- Install a vendor-supported kernel that incorporates applicable referenced Linux stable fixes.
- Use distribution advisories to map installed kernel packages to fixed builds; bundle version boundaries are ambiguous.
- Prioritize remediation where vivid is present and untrusted local users can access video devices.
- If updating is delayed, ask the vendor whether disabling vivid is a supported temporary control.
Validation and detection
- Inventory exact kernel and distribution package versions across Linux systems.
- Determine whether the vivid test driver is built, loadable, loaded, or exposed to untrusted users.
- Verify the installed kernel includes a referenced stable fix or an equivalent vendor backport.
- Review kernel logs for the cited KASAN or vmalloc-out-of-bounds signature; absence does not prove safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38226 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/57597d8db5bbda618ba2145b7e8a7e6f01b6a27eCVE reference, Linux
- https://git.kernel.org/stable/c/635cea4f44c1ddae208666772c164eab5a6bce39CVE reference, Linux
- https://git.kernel.org/stable/c/89b5ab822bf69867c3951dd0eb34b0314c38966bCVE reference, Linux
- https://git.kernel.org/stable/c/5d89aa42534723400fefd46e26e053b9c382b4eeCVE reference, Linux
- https://git.kernel.org/stable/c/f6b1b0f8ba0b61d8b511df5649d57235f230c135CVE reference, Linux
- https://git.kernel.org/stable/c/00da1c767a6567e56f23dda586847586868ac064CVE reference, Linux
- https://git.kernel.org/stable/c/c56398885716d97ee9bcadb2bc9663a8c1757a34CVE reference, Linux
- https://git.kernel.org/stable/c/f83ac8d30c43fd902af7c84c480f216157b60ef0CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.