Critical Vulnerability in Linux Kernel: Improper Stream Handling in Media Subsystems
Summary
CVE-2025-22028: In the Linux kernel, the following vulnerability has been resolved: media: vimc: skip .s_stream() for stopped entities Syzbot reported [1] a warning prompted by a check in call_s_stream() that checks whether .s_stream()... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential functionalities such as process management, memory management, and device control. It supports a wide array of hardware and software configurations, making it a versatile choice for various applications. This vulnerability specifically affects the media subsystem, particularly the Video Input Media Controller (vimc), which is responsible for handling video streams. The issue arises when the .s_stream() operation is incorrectly called for stopped or unstarted entities, potentially leading to system instability.
Vulnerability Detail
The vulnerability, identified as CVE-2025-22028, originates from a flaw in the call_s_stream() function within the Linux kernel's media subsystem. It was reported by Syzbot, indicating that a warning is triggered when the .s_stream() operation is invoked for media entities that have not been properly initialized or have been stopped. This could lead to unexpected behavior or crashes in applications relying on these media streams, posing a risk to system stability and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid invoking the .s_stream() operation for media entities that are not in a started state. This can be achieved by modifying the application logic to check the state of the media entity before calling the streaming function.
Conclusion
CVE-2025-22028 is a critical vulnerability in the Linux kernel's media subsystem that can lead to improper stream handling. Users are strongly encouraged to update their systems to the latest patched version of the kernel to mitigate risks. For those unable to update immediately, implementing a temporary workaround is advisable.
See every vulnerability recorded for linux →
FAQ
CVE-2025-22028 is a vulnerability in the Linux kernel's media subsystem that can lead to improper handling of video streams, potentially causing system instability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability may lead to unexpected behavior or crashes in applications that rely on the media subsystem, affecting system stability and security.
Yes, a patch has been released. Users are advised to update their Linux kernel to the latest version to ensure they are protected against this vulnerability.
If an immediate update is not possible, consider implementing a workaround by checking the state of media entities before invoking the .s_stream() operation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
