CVE-2025-38558: usb: gadget: uvc: Initialize frame-based format color matching descriptor
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: Initialize frame-based format color matching descriptor
Fix NULL pointer crash in uvcgframebasedmake due to uninitialized color matching descriptor for frame-based format which was added in commit f5e7bdd34aca ("usb: gadget: uvc: Allow creating new color matching descriptors") that added handling for uncompressed and mjpeg format.
Crash is seen when userspace configuration (via configfs) does not explicitly define the color matching descriptor. If colormatching is not found, configgroupfinditem() returns NULL. The code then jumps to outputcm, where it calls configitemput(colormatching);. If colormatching is NULL, this will dereference a null pointer, leading to a crash.
[ 2.746440] Unable to handle kernel NULL pointer dereference at virtual address 000000000000008c [ 2.756273] Mem abort info: [ 2.760080] ESR = 0x0000000096000005 [ 2.764872] EC = 0x25: DABT (current EL), IL = 32 bits [ 2.771068] SET = 0, FnV = 0 [ 2.771069] EA = 0, S1PTW = 0 [ 2.771070] FSC = 0x05: level 1 translation fault [ 2.771071] Data abort info: [ 2.771072] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 2.771073] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 2.771074] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 2.771075] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000a3e59000 [ 2.771077] [000000000000008c] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 2.771081] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 2.771084] Dumping ftrace buffer: [ 2.771085] (ftrace buffer empty) [ 2.771138] CPU: 7 PID: 486 Comm: ln Tainted: G W E 6.6.58-android15 [ 2.771139] Hardware name: Qualcomm Technologies, Inc. SunP QRD HDK (DT) [ 2.771140] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 2.771141] pc : uvcgfillstrm+0x198/0x2cc [ 2.771145] lr : uvcgiterstrmcls+0xc8/0x17c [ 2.771146] sp : ffffffc08140bbb0 [ 2.771146] x29: ffffffc08140bbb0 x28: ffffff803bc81380 x27: ffffff8023bbd250 [ 2.771147] x26: ffffff8023bbd250 x25: ffffff803c361348 x24: ffffff803d8e6768 [ 2.771148] x23: 0000000000000004 x22: 0000000000000003 x21: ffffffc08140bc48 [ 2.771149] x20: 0000000000000000 x19: ffffffc08140bc48 x18: ffffffe9f8cf4a00 [ 2.771150] x17: 000000001bf64ec3 x16: 000000001bf64ec3 x15: ffffff8023bbd250 [ 2.771151] x14: 000000000000000f x13: 004c4b40000f4240 x12: 000a2c2a00051615 [ 2.771152] x11: 000000000000004f x10: ffffffe9f76b40ec x9 : ffffffe9f7e389d0 [ 2.771153] x8 : ffffff803d0d31ce x7 : 000f4240000a2c2a x6 : 0005161500028b0a [ 2.771154] x5 : ffffff803d0d31ce x4 : 0000000000000003 x3 : 0000000000000000 [ 2.771155] x2 : ffffffc08140bc50 x1 : ffffffc08140bc48 x0 : 0000000000000000 [ 2.771156] Call trace: [ 2.771157] uvcgfillstrm+0x198/0x2cc [ 2.771157] uvcgiterstrmcls+0xc8/0x17c [ 2.771158] uvcgstreamingclassallowlink+0x240/0x290 [ 2.771159] configfssymlink+0x1f8/0x630 [ 2.771161] vfssymlink+0x114/0x1a0 [ 2.771163] dosymlinkat+0x94/0x28c [ 2.771164] arm64syssymlinkat+0x54/0x70 [ 2.771164] invokesyscall+0x58/0x114 [ 2.771166] el0svccommon+0x80/0xe0 [ 2.771168] doel0svc+0x1c/0x28 [ 2.771169] el0svc+0x3c/0x70 [ 2.771172] el0t64synchandler+0x68/0xbc [ 2.771173] el0t64sync+0x1a8/0x1ac
Initialize color matching descriptor for frame-based format to prevent NULL pointer crash by mirroring the handling done for uncompressed and mjpeg formats.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1020.21~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-36.36.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.16~24.04.1 - Configuration
Initialize or explicitly define the color matching descriptor for the frame-based format to prevent a NULL pointer dereference when configfs does not provide one.
Linux USB gadget UVC frame-based format color matching descriptor = initialized
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38558?
CVE-2025-38558 has been rated as a moderate severity vulnerability due to its potential for causing system instability.
How do I fix CVE-2025-38558?
To mitigate CVE-2025-38558, update to the latest version of the Linux kernel that contains the fix for this vulnerability.
What systems are affected by CVE-2025-38558?
CVE-2025-38558 affects the Linux kernel versions starting from f5e7bdd34aca.
What is the impact of CVE-2025-38558?
The impact of CVE-2025-38558 includes the risk of a NULL pointer dereference leading to a crash in systems utilizing the UVC gadget.
Is CVE-2025-38558 actively exploited?
As of the last report, there is no evidence indicating active exploitation of CVE-2025-38558 in the wild.