Video Interface Vulnerability in Linux Kernel Affecting UVC Devices

CVE-2025-40016

What is CVE-2025-40016?

A vulnerability exists in the Linux kernel's handling of UVC (USB Video Class) devices. The issue arises when invalid entities are assigned a non-unique or zero ID, contrary to the UVC 1.1+ specification requiring non-zero unique identifications. This flaw may lead to unexpected behavior during the creation of media pad links, resulting in warnings or errors when devices are improperly configured. It disrupts normal operations, particularly with non-compliant cameras, by highlighting issues with entity initialization and maintaining valid entity relationships within the video processing chain.

References