Linux Kernel Vulnerability in CXUSB Media Driver by Linux Foundation

CVE-2025-38229

What is CVE-2025-38229?

A vulnerability has been identified in the CXUSB media driver within the Linux kernel. This issue arises during the USB bulk message write operation, where certain conditions lead to an uninitialized variable. Specifically, when the write operation of usb_bulk_msg() fails and the operation returns a length (rlen) of 1, the subsequent read operation from the device does not occur. Consequently, a critical variable, i, is not initialized, which can result in unreliable behavior and potential security risks in systems utilizing this driver.

References