cve 2025 23158

CVE-2025-23158 is a high-impact Linux kernel vulnerability in the Qualcomm VENUS video driver (venus hfi subsystem) that allows an out-of-bounds write via firmware-controlled corruption of a queue size field. Microsoft's advisory lists Azure Linux as a product that includes this open-source library and is therefore potentially affected, but this is a product-scoped attestation and does not guarantee that no other Microsoft product could contain the vulnerable code. Discussions on WindowsForum.com cover the technical details of the OOB write, the affected driver components, and the implications for Azure Linux and potentially other systems.