cbcvebase.
CVE-2025-22027
published 2025-04-16

CVE-2025-22027: In the Linux kernel, the following vulnerability has been resolved: media: streamzap: fix race between device disconnection and urb callback Syzkaller has…

PriorityP416medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.14%
4.2th percentile
In the Linux kernel, the following vulnerability has been resolved: media: streamzap: fix race between device disconnection and urb callback Syzkaller has reported a general protection fault at function ir_raw_event_store_with_filter(). This crash is caused by a NULL pointer dereference of dev->raw pointer, even though it is checked for NULL in the same function, which means there is a race condition. It occurs due to the incorrect order of actions in the streamzap_disconnect() function: rc_unregister_device() is called before usb_kill_urb(). The dev->raw pointer is freed and set to NULL in rc_unregister_device(), and only after that usb_kill_urb() waits for in-progress requests to finish. If rc_unregister_device() is called while streamzap_callback() handler is not finished, this can lead to accessing freed resources. Thus rc_unregister_device() should be called after usb_kill_urb(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Affected

27 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.135-1 (bookworm)linux 6.1.135-1 (bookworm)
debianlinux-6.1< linux 6.1.135-1 (bookworm)linux 6.1.135-1 (bookworm)
linuxlinux
linuxlinux>= 8e9e60640067858e8036d4d43bbf725c60613359 < e11652a6514ec805440c1bb3739e6c6236fffcc7e11652a6514ec805440c1bb3739e6c6236fffcc7
linuxlinux>= 8e9e60640067858e8036d4d43bbf725c60613359 < f1d518c0bad01abe83c2df880274cb6a39f4a457f1d518c0bad01abe83c2df880274cb6a39f4a457
linuxlinux>= 8e9e60640067858e8036d4d43bbf725c60613359 < 30ef7cfee752ca318d5902cb67b60d9797ccd37830ef7cfee752ca318d5902cb67b60d9797ccd378
linuxlinux>= 8e9e60640067858e8036d4d43bbf725c60613359 < 15483afb930fc2f883702dc96f80efbe4055235e15483afb930fc2f883702dc96f80efbe4055235e
linuxlinux>= 8e9e60640067858e8036d4d43bbf725c60613359 < adf0ddb914c9e5b3e50da4c97959e82de2df75c3adf0ddb914c9e5b3e50da4c97959e82de2df75c3
linuxlinux>= 8e9e60640067858e8036d4d43bbf725c60613359 < 4db62b60af2ccdea6ac5452fd20e29587ed85f574db62b60af2ccdea6ac5452fd20e29587ed85f57
linuxlinux>= 8e9e60640067858e8036d4d43bbf725c60613359 < 8760da4b9d44c36b93b6e4cf401ec7fe520015bd8760da4b9d44c36b93b6e4cf401ec7fe520015bd
linuxlinux>= 8e9e60640067858e8036d4d43bbf725c60613359 < f656cfbc7a293a039d6a0c7100e1c846845148c1f656cfbc7a293a039d6a0c7100e1c846845148c1
linuxlinux_kernel>= 0 < 5.10.237-15.10.237-1
linuxlinux_kernel>= 0 < 6.1.135-16.1.135-1
linuxlinux_kernel>= 0 < 6.12.25-16.12.25-1
linuxlinux_kernel>= 0 < 6.12.25-16.12.25-1
linuxlinux_kernel>= 0 < 5.15.0-144.1575.15.0-144.157
linuxlinux_kernel>= 0 < 6.8.0-86.876.8.0-86.87
linuxlinux_kernel>= 0 < 6.14.0-22.226.14.0-22.22
linuxlinux_kernel>= 2.6.36 < 6.1.1346.1.134
linuxlinux_kernel>= 6.13 < 6.13.116.13.11
linuxlinux_kernel>= 6.14 < 6.14.26.14.2
linuxlinux_kernel>= 6.2 < 6.6.876.6.87
linuxlinux_kernel>= 6.7 < 6.12.236.12.23
msrcazl3_kernel_6.6.85.1-4_on_azure_linux_3.0
msrcazure_linux_3.0_arm

CVSS provenance

nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian4.7MEDIUM
vendor_msrc4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.