CVE-2025-22027

MEDIUM EPSS 2.6%
Published Apr 16, 20251y ago · Modified Jun 17, 20261w ago
4.7 CVSS 3.1
Medium
Find Similar
Published Apr 16, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: media: streamzap: fix race between device disconnection and urb callback Syzkaller has reported a general protection fault at function ir_raw_event_store_with_filter(). This crash is caused by a NULL pointer dereference of dev->raw pointer, even though it is checked for NULL in the same function, which means there is a race condition. It occurs due to the incorrect order of actions in the streamzap_disconnect() function: rc_unregister_device() is called before usb_kill_urb(). The dev->raw pointer is freed and set to NULL in rc_unregister_device(), and only after that usb_kill_urb() waits for in-progress requests to finish. If rc_unregister_device() is called while streamzap_callback() handler is not finished, this can lead to accessing freed resources. Thus rc_unregister_device() should be called after usb_kill_urb(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

CVSS Details

Base Score
4.7
Exploitability
1.0
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
2.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-362
CWE-476 NULL Pointer Dereference Memory Safety

Affected Products 5

VendorProductVersionRange
linuxlinux_kernel*≥2.6.36  –  <6.1.134
linuxlinux_kernel*≥6.2  –  <6.6.87
linuxlinux_kernel*≥6.7  –  <6.12.23
linuxlinux_kernel*≥6.13  –  <6.13.11
linuxlinux_kernel*≥6.14  –  <6.14.2

References 10

  • git.kernel.org https://git.kernel.org/stable/c/15483afb930fc2f883702dc96f80efbe4055235e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/30ef7cfee752ca318d5902cb67b60d9797ccd378
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4db62b60af2ccdea6ac5452fd20e29587ed85f57
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8760da4b9d44c36b93b6e4cf401ec7fe520015bd
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/adf0ddb914c9e5b3e50da4c97959e82de2df75c3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e11652a6514ec805440c1bb3739e6c6236fffcc7
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f1d518c0bad01abe83c2df880274cb6a39f4a457
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f656cfbc7a293a039d6a0c7100e1c846845148c1
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/15483afb930fc2f883702dc96f80efbe4055235e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/30ef7cfee752ca318d5902cb67b60d9797ccd378
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4db62b60af2ccdea6ac5452fd20e29587ed85f57
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8760da4b9d44c36b93b6e4cf401ec7fe520015bd
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/adf0ddb914c9e5b3e50da4c97959e82de2df75c3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e11652a6514ec805440c1bb3739e6c6236fffcc7
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f1d518c0bad01abe83c2df880274cb6a39f4a457
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f656cfbc7a293a039d6a0c7100e1c846845148c1
    Patch