Riskcovery

CVE-2025-37971

staging: bcm2835-camera: Initialise dev in v4l2_dev

State
Published
Severity
Not scored
Published
May 20, 2025
Updated
May 11, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

staging: bcm2835-camera: Initialise dev in v4l2_dev

Commit 42a2f6664e18 ("staging: vc04_services: Move global g_state to vchiq_state") changed mmal_init to pass dev->v4l2_dev.dev to vchiq_mmal_init, however nothing iniitialised dev->v4l2_dev, so we got a NULL pointer dereference.

Set dev->v4l2_dev.dev during bcm2835_mmal_probe. The device pointer could be passed into v4l2_device_register to set it, however that also has other effects that would need additional changes.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 42a2f6664e18874302623f31edef545ef41e1d14 to before 06753f49336ab161ea0e249a0720125b81b7b31bAffected
  • 42a2f6664e18874302623f31edef545ef41e1d14 to before b70bdd4923e8b8edbacde2af83ca337bb7005261Affected
  • 42a2f6664e18874302623f31edef545ef41e1d14 to before 98698ca0e58734bc5c1c24e5bbc7429f981cd186Affected
LinuxLinux
  • 6.10Affected
  • before 6.10Not affected
  • 6.12.29 through 6.12.*Not affected
  • 6.14.7 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.