CVE-2025-38068

crypto: lzo - Fix compression buffer overrun

published June 18, 2025

CVSS
—
EPSS
0%
Percentile
8.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

crypto: lzo - Fix compression buffer overrun

Unlike the decompression code, the compression code in LZO never

checked for output overruns. It instead assumes that the caller

always provides enough buffer space, disregarding the buffer length

provided by the caller.

Add a safe compression interface that checks for the end of buffer

before each write. Use the safe interface in crypto/lzo.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00191 · 8.3th percentile
Published
2025-06-18T09:33Z
EPSS history
Timeline
  • 18 JUN 09:33Z
    crypto: lzo - Fix compression buffer overrun
    cvelistv5