CVE-2025-40016

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID

Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero

unique ID.

```

Each Unit and Terminal within the video function is assigned a unique

identification number, the Unit ID (UID) or Terminal ID (TID), contained in

the bUnitID or bTerminalID field of the descriptor. The value 0x00 is

reserved for undefined ID,

```

If we add a new entity with id 0 or a duplicated ID, it will be marked

as UVC_INVALID_ENTITY_ID.

In a previous attempt commit 3dd075fe8ebb ("media: uvcvideo: Require

entities to have a non-zero unique ID"), we ignored all the invalid units,

this broke a lot of non-compatible cameras. Hopefully we are more lucky

this time.

This also prevents some syzkaller reproducers from triggering warnings due

to a chain of entities referring to themselves. In one particular case, an

Output Unit is connected to an Input Unit, bot

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References