In the Linux kernel, the following vulnerability has been resolved:
media: streamzap: fix race between device disconnection and urb callback
Syzkaller has reported a general protection fault at function irraweventstorewithfilter(). This crash is caused by a NULL pointer dereference of dev->raw pointer, even though it is checked for NULL in the same function, which means there is a race condition. It occurs due to the incorrect order of actions in the streamzapdisconnect() function: rcunregisterdevice() is called before usbkillurb(). The dev->raw pointer is freed and set to NULL in rcunregisterdevice(), and only after that usbkillurb() waits for in-progress requests to finish.
If rcunregisterdevice() is called while streamzapcallback() handler is not finished, this can lead to accessing freed resources. Thus rcunregisterdevice() should be called after usbkill_urb().
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22027.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-22027.json"
[
{
"signature_type": "Function",
"id": "CVE-2025-22027-17896470",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adf0ddb914c9e5b3e50da4c97959e82de2df75c3",
"signature_version": "v1",
"target": {
"function": "streamzap_disconnect",
"file": "drivers/media/rc/streamzap.c"
},
"deprecated": false,
"digest": {
"function_hash": "203261239970903426762050148616921696795",
"length": 338.0
}
},
{
"signature_type": "Line",
"id": "CVE-2025-22027-20175e0d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adf0ddb914c9e5b3e50da4c97959e82de2df75c3",
"target": {
"file": "drivers/media/rc/streamzap.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"109573800500976148022454633314563174399",
"262185955005279133876220210143490112812",
"41492202942994065562158980329254438705",
"4801177951935662985921105761036191475",
"94674849753030579095832241637881320840"
]
}
}
]