CVE-2025-38558

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: uvc: Initialize frame-based format color matching descriptor

Fix NULL pointer crash in uvcg_framebased_make due to uninitialized color

matching descriptor for frame-based format which was added in

commit f5e7bdd34aca ("usb: gadget: uvc: Allow creating new color matching

descriptors") that added handling for uncompressed and mjpeg format.

Crash is seen when userspace configuration (via configfs) does not

explicitly define the color matching descriptor. If color_matching is not

found, config_group_find_item() returns NULL. The code then jumps to

out_put_cm, where it calls config_item_put(color_matching);. If

color_matching is NULL, this will dereference a null pointer, leading to a

crash.

[ 2.746440] Unable to handle kernel NULL pointer dereference at virtual address 000000000000008c

[ 2.756273] Mem abort info:

[ 2.760080] ESR = 0x0000000096000005

[ 2.764872] EC = 0x25: DABT (current EL),

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References