CVE-2025-37971: staging: bcm2835-camera: Initialise dev in v4l2_dev
In the Linux kernel, the following vulnerability has been resolved:
staging: bcm2835-camera: Initialise dev in v4l2dev
Commit 42a2f6664e18 ("staging: vc04services: Move global gstate to vchiqstate") changed mmalinit to pass dev->v4l2dev.dev to vchiqmmalinit, however nothing iniitialised dev->v4l2dev, so we got a NULL pointer dereference.
Set dev->v4l2dev.dev during bcm2835mmalprobe. The device pointer could be passed into v4l2deviceregister to set it, however that also has other effects that would need additional changes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 42a2f6664e18
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37971?
CVE-2025-37971 has a severity rating that indicates it can potentially lead to system instability or crashes.
How do I fix CVE-2025-37971?
To resolve CVE-2025-37971, ensure that you update to the latest version of the Linux kernel that includes the fix.
What software is affected by CVE-2025-37971?
CVE-2025-37971 affects the Linux kernel specifically related to the bcm2835-camera.
What impact does CVE-2025-37971 have on Linux systems?
CVE-2025-37971 may cause a malfunction in the bcm2835-camera driver, leading to potential data loss or system errors.
Is CVE-2025-37971 a remote exploit?
CVE-2025-37971 is not classified as a remote exploit; it requires local access to the affected system.