DEBIAN-CVE-2025-37971

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2025-37971
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-37971.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2025-37971
Upstream
Published
2025-05-20T17:15:47Z
Modified
2025-09-25T04:38:26.929388Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved: staging: bcm2835-camera: Initialise dev in v4l2dev Commit 42a2f6664e18 ("staging: vc04services: Move global gstate to vchiqstate") changed mmalinit to pass dev->v4l2dev.dev to vchiqmmalinit, however nothing iniitialised dev->v4l2dev, so we got a NULL pointer dereference. Set dev->v4l2dev.dev during bcm2835mmalprobe. The device pointer could be passed into v4l2deviceregister to set it, however that also has other effects that would need additional changes.

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.29-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.29-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}