CVE-2025-38229

What it actually does

Uninitialized stack value 'i' is used in cxusb_gpio_tuner after usb_bulk_msg write fails in dvb_usb_generic_rw, skipping the subsequent read that would have populated rbuf, resulting in KMSAN-detected uninit-value use during i2c transfers on cxusb devices.

Why it matters to the business

Systems using cxusb-based DVB-USB tuners may experience kernel crashes or information disclosure during I2C operations; the issue affects a narrow set of media hardware with a fix available since July 2025 and low exploitation probability.

How an attack unfolds

An attacker with local access crafts I2C write sequences that cause usb_bulk_msg to fail while rlen>0, triggering the uninitialized read path in cxusb_i2c_xfer and potentially leaking kernel memory or causing denial of service; listed threat actors have not been observed exploiting this specific flaw.

How to fix it

Update the Linux kernel to commit 77829a5f5a74026b888b0529628475b29750cef4 or later; for Chainguard packages apply the fixed 0 revision when available; disable the cxusb driver module if the hardware is not required.

How to confirm the fix worked

Confirm the running kernel contains commit 77829a5f5a74026b888b0529628475b29750cef4, reproduce the syzbot reproducer under KMSAN, and verify absence of uninit-value reports in cxusb_i2c_xfer.

Typical attack path

1. Obtain local code execution on a Linux system with cxusb DVB-USB hardware attached
2. Trigger i2c_master_send or equivalent write that forces usb_bulk_msg failure
3. Force rlen>0 condition so the read path is skipped
4. Observe use of uninitialized 'i' in cxusb_gpio_tuner leading to crash or data leak

How to detect it

Search kernel logs for KMSAN uninit-value reports referencing cxusb_gpio_tuner or cxusb_i2c_xfer; inspect USB bulk transfer failures followed by i2c activity on affected devices.

• cxusb_i2c_xfer+0x153a/0x1a60
• BUG: KMSAN: uninit-value in cxusb_gpio_tuner
• drivers/media/usb/dvb-usb/cxusb.c:124

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on any system exposing cxusb hardware
• Audit for presence of cxusb module in production kernels and remove if unused
• Monitor KMSAN and kernel bug reports for similar uninit-value patterns in media drivers