Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-38229— media: cxusb: no longer judge rbuf when the write fails

AI Predicted 5.5 Difficulty: Moderate EPSS 0.15% · P5

Affected Version Matrix 18

VendorProductVersion RangeStatus
LinuxLinux22c6d93a73105fddd58796d7cb10f5f90ee2a338< 77829a5f5a74026b888b0529628475b29750cef4affected
22c6d93a73105fddd58796d7cb10f5f90ee2a338< 390b864e3281802109dfe56e508396683e125653affected
22c6d93a73105fddd58796d7cb10f5f90ee2a338< 41807a5f67420464ac8ee7741504f6b5decb3b7caffected
22c6d93a73105fddd58796d7cb10f5f90ee2a338< 84eca597baa346f09b30accdaeca10ced3eeba2daffected
22c6d93a73105fddd58796d7cb10f5f90ee2a338< 04354c529c8246a38ae28f713fd6bfdc028113bcaffected
22c6d93a73105fddd58796d7cb10f5f90ee2a338< 9bff888c92f5c25effbb876d22a793c2388c1cccaffected
22c6d93a73105fddd58796d7cb10f5f90ee2a338< 8b35b50b7e98d8e9a0a27257c8424448afae10deaffected
22c6d93a73105fddd58796d7cb10f5f90ee2a338< 73fb3b92da84637e3817580fa205d48065924e15affected
… +10 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-38229

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
media: cxusb: no longer judge rbuf when the write fails
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: media: cxusb: no longer judge rbuf when the write fails syzbot reported a uninit-value in cxusb_i2c_xfer. [1] Only when the write operation of usb_bulk_msg() in dvb_usb_generic_rw() succeeds and rlen is greater than 0, the read operation of usb_bulk_msg() will be executed to read rlen bytes of data from the dvb device into the rbuf. In this case, although rlen is 1, the write operation failed which resulted in the dvb read operation not being executed, and ultimately variable i was not initialized. [1] BUG: KMSAN: uninit-value in cxusb_gpio_tuner drivers/media/usb/dvb-usb/cxusb.c:124 [inline] BUG: KMSAN: uninit-value in cxusb_i2c_xfer+0x153a/0x1a60 drivers/media/usb/dvb-usb/cxusb.c:196 cxusb_gpio_tuner drivers/media/usb/dvb-usb/cxusb.c:124 [inline] cxusb_i2c_xfer+0x153a/0x1a60 drivers/media/usb/dvb-usb/cxusb.c:196 __i2c_transfer+0xe25/0x3150 drivers/i2c/i2c-core-base.c:-1 i2c_transfer+0x317/0x4a0 drivers/i2c/i2c-core-base.c:2315 i2c_transfer_buffer_flags+0x125/0x1e0 drivers/i2c/i2c-core-base.c:2343 i2c_master_send include/linux/i2c.h:109 [inline] i2cdev_write+0x210/0x280 drivers/i2c/i2c-dev.c:183 do_loop_readv_writev fs/read_write.c:848 [inline] vfs_writev+0x963/0x14e0 fs/read_write.c:1057 do_writev+0x247/0x5c0 fs/read_write.c:1101 __do_sys_writev fs/read_write.c:1169 [inline] __se_sys_writev fs/read_write.c:1166 [inline] __x64_sys_writev+0x98/0xe0 fs/read_write.c:1166 x64_sys_call+0x2229/0x3c80 arch/x86/include/generated/asm/syscalls_64.h:21 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于cxusb驱动在写入失败时错误判断rbuf状态，可能导致未初始化值使用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 22c6d93a73105fddd58796d7cb10f5f90ee2a338 ~ 77829a5f5a74026b888b0529628475b29750cef4 -
LinuxLinux 2.6.13 -

II. Public POCs for CVE-2025-38229

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38229

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-07-04 · 59 CVEs total

CVE-2025-382099.8 CRITICALnvme-tcp: remove tag set when second admin queue config fails
CVE-2025-382119.8 CRITICALRDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
CVE-2025-381748.8 HIGHthunderbolt: Do not double dequeue a configuration request
CVE-2025-382168.8 HIGHiommu/vt-d: Restore context entry setup order for aliased devices
CVE-2025-382337.8 HIGHpowerpc64/ftrace: fix clobbered r15 during livepatching
CVE-2025-382307.8 HIGHjfs: validate AG parameters in dbMount() to prevent crashes
CVE-2025-382277.8 HIGHmedia: vidtv: Terminating the subsequent process of initialization failure
CVE-2025-382267.8 HIGHmedia: vivid: Change the siize of the composing
CVE-2025-382247.8 HIGHcan: kvaser_pciefd: refine error prone echo_skb_max handling logic
CVE-2025-382187.8 HIGHf2fs: fix to do sanity check on sit_bitmap_size
CVE-2025-382327.8 HIGHNFSD: fix race between nfsd registration and exports_proc
CVE-2025-382127.8 HIGHipc: fix to protect IPCS lookups using RCU
CVE-2025-381757.8 HIGHbinder: fix yet another UAF in binder_devices
CVE-2025-382347.8 HIGHsched/rt: Fix race in push_rt_task
CVE-2025-382067.8 HIGHexfat: fix double free in delayed_free
CVE-2025-382047.8 HIGHjfs: fix array-index-out-of-bounds read in add_missing_indices
CVE-2025-381927.8 HIGHnet: clear the dst when changing skb protocol
CVE-2025-381877.8 HIGHdrm/nouveau: fix a use-after-free in r535_gsp_rpc_push()
CVE-2025-381847.8 HIGHtipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
CVE-2025-381807.8 HIGHnet: atm: fix /proc/net/atm/lec handling

Showing top 20 of 59 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38229

No comments yet

Leave a comment