Use-After-Free Vulnerability in Linux Kernel Media Drivers by Google

CVE-2025-38227

What is CVE-2025-38227?

This vulnerability exists in the Linux kernel's media drivers involving the vidtv subsystem, where improper handling of memory can lead to a use-after-free scenario. Specifically, when the initialization of the PSI (Program Specific Information) fails, the code erroneously accesses the 'si' structure, which can have severe implications in the memory management of the kernel. The issue manifests during the initialization sequence of the vidtv_mux_init function, causing a potential read access violation. Proper memory cleanup must be performed to prevent such vulnerabilities from being exploited.

References