CVE-2025-22027

Summary

CVE-2025-22027 is a vulnerability affecting the Linux kernel's media subsystem, specifically the streamzap driver. The issue was discovered by Syzkaller and reported as a NULL pointer dereference in the ir_raw_event_store_with_filter() function. The root cause is a race condition between device disconnection and urb (USB Request Block) callback. The streamzap_disconnect() function calls rc_unregister_device() before usb_kill_urb(), leading to the dev->raw pointer being freed and set to NULL before usb_kill_urb() waits for in-progress requests to finish. This misorder of actions can result in accessing freed resources, potentially causing system instability or crashes. The Linux Verification Center identified and reported this vulnerability to mitigate related security risks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.