media: uvcvideo: Remove dangling pointers (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.26 % · percentile 17 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Remove dangling pointers When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done. Which could be anytime in the future. If the user closes that file descriptor, its structure will be freed, and there will be one dangling pointer per pending async control, that the driver will try to use. Clean all the dangling pointers during release(). To avoid adding a performance penalty in the most common case (no async operation), a counter has been introduced with some logic to make sure that it is properly handled.
Weaknesses (CWE)
- CWE-416 — Use After Free
References
- https://git.kernel.org/stable/c/2a29413ace64627e178fd422dd8a5d95219a2c0b
- https://git.kernel.org/stable/c/653993f46861f2971e95e9a0e36a34b49dec542c
- https://git.kernel.org/stable/c/117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50
- https://git.kernel.org/stable/c/ac18d781466252cd35a3e311e0a4b264260fd927
- https://git.kernel.org/stable/c/4dbaa738c583a0e947803c69e8996e88cf98d971
- https://git.kernel.org/stable/c/438bda062b2c40ddd7df23b932e29ffe0a448cac
- https://git.kernel.org/stable/c/9edc7d25f7e49c33a1ce7a5ffadea2222065516c
- https://git.kernel.org/stable/c/221cd51efe4565501a3dbf04cc011b537dcce7fb
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-5217
- GCVE · GCVE-0-2024-58002
CERT-FR advisories
- CERTFR-2026-AVI-1298 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0758 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0746 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0699 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0669 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0626 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0625 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0606 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0605 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0559 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0509 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0463 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0333 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0307 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.19 < 6.6.80cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.14cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.13.3
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected e5225c820c057537dc780244760e2e24c7d27366 < 2a29413ace64627e178fd422dd8a5d95219a2c0b ; affected e5225c820c057537dc780244760e2e24c7d27366 < 653993f46861f2971e95e9a0e36a34b49dec542c ; affected e5225c820c057537dc780244760e2e24c7d27366 < 117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50 ; affected e5225c820c057537dc780244760e2e24c7d27366 < ac18d781466252cd35a3e311e0a4b264260fd927 ; affected e5225c820c057537dc780244760e2e24c7d27366 < 4dbaa738c583a0e947803c69e8996e88cf98d971 ; affected e5225c820c057537dc780244760e2e24c7d27366 < 438bda062b2c40ddd7df23b932e29ffe0a448cac |
| Linux · Linux | affected 4.19 ; unaffected 0 < 4.19 ; unaffected 5.4.291 ≤ 5.4.* ; unaffected 5.10.235 ≤ 5.10.* ; unaffected 5.15.179 ≤ 5.15.* ; unaffected 6.1.130 ≤ 6.1.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |