CVE-2025-22028

What it actually does

The vulnerability permits vimc_streamer_pipeline_terminate to invoke .s_stream() on entities that were never started or have already been stopped, violating the check in call_s_stream() within v4l2-subdev and generating a kernel warning.

Why it matters to the business

Organizations running Linux kernels with the vimc virtual media driver may observe kernel warnings or minor instability during video capture operations in test or development environments; the issue affects a widely used kernel component but has low exploitability and no known ransomware usage.

How an attack unfolds

An attacker triggers repeated V4L2 stream-on and stream-off sequences through user-space ioctls on a vimc capture device, causing the pipeline termination path to call .s_stream() on an already-stopped subdev and hitting the warning check.

How to fix it

Upgrade the Linux kernel to a version containing commit a505075730d23ccc19fc4ac382a0ed73b630c057; for Red Hat Enterprise Linux 9 systems also update buildah packages to 2:1.33.10-1.el9_4 or later.

How to confirm the fix worked

Verify the presence of commit a505075730d23ccc19fc4ac382a0ed73b630c057 in the kernel source or confirm that vimc_streamer_pipeline_terminate now guards the .s_stream() call with a started-entity check; re-run the original syzbot reproducer to confirm the warning no longer triggers.

Typical attack path

1. Open a vimc video capture device via V4L2
2. Issue VIDIOC_STREAMON to start streaming
3. Issue VIDIOC_STREAMOFF or trigger pipeline termination
4. Repeat operations rapidly to hit the unstarted-entity path in vimc_streamer_pipeline_terminate
5. Observe kernel warning or potential follow-on behavior

How to detect it

Search kernel logs for the exact warning emitted by call_s_stream at drivers/media/v4l2-core/v4l2-subdev.c:460 and for call traces containing vimc_streamer_pipeline_terminate or vimc_capture_start_streaming; examine audit logs for unusual V4L2 ioctl sequences on vimc devices.

• WARNING: CPU:.*at drivers/media/v4l2-core/v4l2-subdev.c:460 call_s_stream
• vimc_streamer_pipeline_terminate+0x218/0x320
• syz-executor.*vimc

What your security team should do

• Apply the kernel fix containing commit a505075730d23ccc19fc4ac382a0ed73b630c057 at the earliest maintenance window
• Update affected Red Hat Enterprise Linux 9 buildah packages to 2:1.33.10-1.el9_4
• Monitor kernel logs for the call_s_stream warning string during video device testing
• Limit exposure of V4L2 devices on systems where vimc is enabled if patching is delayed