CVE-2025-38229 — Use of Uninitialized Resource in Linux
CWE-908 — Use of Uninitialized ResourceCWE-909 — Missing Initialization of Resource67 documents8 sources
Severity
5.5MEDIUMNVD
OSV5.6OSV3.2
EPSS
0.0%
top 90.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 4
Latest updateMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
media: cxusb: no longer judge rbuf when the write fails
syzbot reported a uninit-value in cxusb_i2c_xfer. [1]
Only when the write operation of usb_bulk_msg() in dvb_usb_generic_rw()
succeeds and rlen is greater than 0, the read operation of usb_bulk_msg()
will be executed to read rlen bytes of data from the dvb device into the
rbuf.
In this case, although rlen is 1, the write operation failed which resulted
in the dvb read o…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
▶CVEListV5linux/linux22c6d93a73105fddd58796d7cb10f5f90ee2a338 — 77829a5f5a74026b888b0529628475b29750cef4+8
Also affects: Debian Linux 11.0