CVE-2025-22027

What it actually does

Race condition in streamzap driver causes NULL pointer dereference of dev->raw in ir_raw_event_store_with_filter() because rc_unregister_device() frees the pointer before usb_kill_urb() completes pending callbacks.

Why it matters to the business

Kernel crashes or faults on affected Linux systems can lead to denial of service, unplanned reboots, and operational disruption with moderate urgency given low EPSS and no KEV status.

How an attack unfolds

An attacker triggers device disconnection while a streamzap_callback() URB handler is still executing, allowing access to freed resources after rc_unregister_device() has run; related Linux kernel privilege escalation patterns observed in similar CVEs may provide context for local attackers.

How to fix it

Reorder calls so usb_kill_urb() precedes rc_unregister_device() in streamzap_disconnect(); apply kernel updates and the listed fixed package versions for Red Hat rhel_eus:8.8 such as pki-core 0:10.14.3-3.module+el8.8.0+22366+77f9de5e, jss 0:4.9.4-1.module+el8.7.0+15532+95bac9ee, and ldapjdk 0:4.23.0-1.module+el8.5.0+11983+6ba118b4.

How to confirm the fix worked

Confirm rc_unregister_device() occurs after usb_kill_urb() in disconnect handler; verify updated package versions are installed and test device connect/disconnect sequences for absence of general protection faults.

Typical attack path

1. Attach streamzap device and initiate URB transfers
2. Trigger concurrent device disconnection
3. Execute rc_unregister_device() before URB kill completes
4. Access freed dev->raw pointer during callback

How to detect it

Search kernel logs for general protection faults referencing ir_raw_event_store_with_filter() or streamzap during device disconnect events; correlate with USB subsystem activity and any related privilege escalation attempts noted in threat actor reports for similar kernel issues.

What your security team should do

• Prioritize kernel and affected Red Hat package updates within standard patching cycles given low EPSS
• Monitor for similar race conditions in USB/media drivers
• Review logs for NULL dereference crashes in ir_raw_event_store_with_filter()