CVE-2025-22027

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-22027
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-22027.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-22027
Downstream
Related
Published
2025-04-16T14:11:48.210Z
Modified
2026-05-07T04:16:26.194487Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
media: streamzap: fix race between device disconnection and urb callback
Details

In the Linux kernel, the following vulnerability has been resolved:

media: streamzap: fix race between device disconnection and urb callback

Syzkaller has reported a general protection fault at function irraweventstorewithfilter(). This crash is caused by a NULL pointer dereference of dev->raw pointer, even though it is checked for NULL in the same function, which means there is a race condition. It occurs due to the incorrect order of actions in the streamzapdisconnect() function: rcunregisterdevice() is called before usbkillurb(). The dev->raw pointer is freed and set to NULL in rcunregisterdevice(), and only after that usbkillurb() waits for in-progress requests to finish.

If rcunregisterdevice() is called while streamzapcallback() handler is not finished, this can lead to accessing freed resources. Thus rcunregisterdevice() should be called after usbkill_urb().

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22027.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
8e9e60640067858e8036d4d43bbf725c60613359
Fixed
e11652a6514ec805440c1bb3739e6c6236fffcc7
Fixed
f1d518c0bad01abe83c2df880274cb6a39f4a457
Fixed
30ef7cfee752ca318d5902cb67b60d9797ccd378
Fixed
15483afb930fc2f883702dc96f80efbe4055235e
Fixed
adf0ddb914c9e5b3e50da4c97959e82de2df75c3
Fixed
4db62b60af2ccdea6ac5452fd20e29587ed85f57
Fixed
8760da4b9d44c36b93b6e4cf401ec7fe520015bd
Fixed
f656cfbc7a293a039d6a0c7100e1c846845148c1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-22027.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.36
Fixed
5.10.237
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.181
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.134
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.87
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.23
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.13.11
Type
ECOSYSTEM
Events
Introduced
6.14.0
Fixed
6.14.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-22027.json"