Security readout for executives and security teams
Plain-English summary
CVE-2025-22022 is a Linux kernel USB xHCI issue tied to NEC uPD720200 controllers handling isochronous endpoints, such as high-bandwidth video devices. Under missed service errors, the controller may read past a transfer ring segment, causing IOMMU faults and possible incorrect buffer writes. Exposure is hardware-specific and not broadly internet-facing.
Executive priority
Treat this as targeted infrastructure hygiene rather than an emergency internet-wide issue. Prioritize patching systems with NEC uPD720200 USB controllers in operational, appliance, media, lab, or workstation environments where USB device reliability and data integrity matter.
Technical view
The Linux xHCI driver did not apply a link-chain quirk to NEC isochronous rings. The source describes missed service errors near segment ends, followed by IOMMU faults, buffer overrun events, and transfer events outside the current TD. The kernel fix sets the chain bit on Link TRBs for affected isochronous rings.
Likely exposure
Likely exposure is limited to Linux systems using NEC uPD720200 xHCI USB host controllers with isochronous USB devices, especially bandwidth-heavy UVC devices. Servers, workstations, kiosks, or appliances with these controllers deserve review. Systems without this hardware path are unlikely to be affected based on the provided sources.
Exploitation context
The bundle does not show active exploitation, and KEV is false. The described trigger involves bandwidth-starved NEC hardware, missed service errors, and specific USB transfer conditions. This looks more like local hardware-triggered kernel memory or I/O corruption risk than a remote network exposure.
Researcher notes
Evidence is strongest for NEC uPD720200 behavior under missed service errors on isochronous endpoints. The source explicitly says random buffer writes are possible, but does not prove exploitability or privilege impact. No CVSS, CWE, or active exploitation evidence is included in the bundle.
Mitigation direction
- Update Linux kernels to versions containing the referenced stable fixes.
- Check distribution vendor guidance for backported kernel fixes.
- Prioritize hosts with NEC uPD720200 controllers and high-bandwidth USB devices.
- Temporarily reduce or remove risky isochronous USB workloads where practical.
- Avoid assuming non-upstream kernels are fixed without vendor confirmation.
Validation and detection
- Inventory Linux hosts for NEC uPD720200 xHCI USB controllers.
- Identify attached isochronous USB devices, especially UVC cameras.
- Confirm the running kernel includes one referenced stable commit or vendor backport.
- Review logs for xhci_hcd missed service errors and IOMMU faults.
- Track affected kernel versions against distribution security advisories.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit abf2df229b6a9172cc1827749c1a446d28e00a2e
- Linux stable commit 8b586de6f03c850ff48d42e539b4708d1f3f8f1a
- Linux stable commit 1143f790a6316201dc8f067eba4c94ea97ecb6ca
- Linux stable commit dbf427663ce272070d3004b5fca63a4a537d781c
- Linux stable commit a4931d9fb99eb5462f3eaa231999d279c40afb21
- Linux stable commit 43a18225150ce874d23b37761c302a5dffee1595
- Linux stable commit 061a1683bae6ef56ab8fa392725ba7495515cd1d
- Linux stable commit bb0ba4cb1065e87f9cc75db1fa454e56d0894d01
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22022 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/abf2df229b6a9172cc1827749c1a446d28e00a2eCVE reference, Linux
- https://git.kernel.org/stable/c/8b586de6f03c850ff48d42e539b4708d1f3f8f1aCVE reference, Linux
- https://git.kernel.org/stable/c/1143f790a6316201dc8f067eba4c94ea97ecb6caCVE reference, Linux
- https://git.kernel.org/stable/c/dbf427663ce272070d3004b5fca63a4a537d781cCVE reference, Linux
- https://git.kernel.org/stable/c/a4931d9fb99eb5462f3eaa231999d279c40afb21CVE reference, Linux
- https://git.kernel.org/stable/c/43a18225150ce874d23b37761c302a5dffee1595CVE reference, Linux
- https://git.kernel.org/stable/c/061a1683bae6ef56ab8fa392725ba7495515cd1dCVE reference, Linux
- https://git.kernel.org/stable/c/bb0ba4cb1065e87f9cc75db1fa454e56d0894d01CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.