CVE-2025-22027

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition in the Linux kernel's streamzap driver can cause a general protection fault due to a NULL pointer dereference of the dev->raw pointer. This occurs because rc unregister device() is called before usb kill urb(), freeing the dev->raw pointer and setting it to NULL, while usb kill urb() waits for in-progress requests to finish. If rc unregister device() is called while the streamzap callback() handler is not finished, it can lead to accessing freed resources. The issue is caused by the incorrect order of actions in the streamzap disconnect() function.

Recommendations To resolve the issue, rc unregister device() should be called after usb kill urb() in the streamzap disconnect() function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.