Security readout for executives and security teams
Plain-English summary
CVE-2025-22028 is a Linux kernel issue in the VIMC virtual media test driver. The evidence shows a syzbot-triggered kernel warning when stream shutdown calls a media subdevice operation for an entity that was not properly started. No public source in the bundle shows active exploitation, data theft, or remote attack impact.
Executive priority
Treat this as a kernel maintenance item unless local evidence shows VIMC is exposed in sensitive systems. Prioritize through normal kernel patch cycles, with faster action for shared hosts, test infrastructure, or systems that enable media test drivers.
Technical view
The flaw is in drivers/media/test-drivers/vimc/vimc-streamer.c. During pipeline termination, vimc_streamer_pipeline_terminate() could call .s_stream() on stopped or unstarted entities, triggering the v4l2 call_s_stream() warning. Kernel stable commits add a guard so only previously started entities receive the stop-stream call.
Likely exposure
Exposure appears limited to Linux systems running affected kernel builds with the VIMC media test driver present and usable. The bundle lists Linux as affected across several kernel lines, but does not provide distro package names, CPEs, CVSS, or deployment prevalence.
Exploitation context
The cited evidence is a syzbot report reaching the issue through V4L2 streaming paths and a kernel fix. The bundle marks KEV as false and provides no cited evidence of exploitation in the wild or weaponized public exploit activity.
Researcher notes
The source bundle does not establish memory corruption, privilege escalation, or denial-of-service beyond a kernel warning. Analysis should focus on whether downstream kernels ship VIMC, whether it is reachable by unprivileged users, and whether vendor patches map to the listed stable commits.
Mitigation direction
- Check Linux distribution advisories for packages containing the referenced stable fixes.
- Update affected kernels once vendor-supported fixed builds are available.
- Review whether VIMC is enabled or loaded on production systems.
- If VIMC is unnecessary, follow vendor guidance for disabling unused test drivers.
Validation and detection
- Inventory kernel versions and compare against vendor fixed package guidance.
- Check kernel configuration or loaded modules for VIMC media test driver presence.
- Confirm patched kernels include one of the referenced stable commits or downstream equivalent.
- Review media-device access controls for users allowed to exercise V4L2 streaming paths.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit a505075730d23ccc19fc4ac382a0ed73b630c057
- Linux stable commit 845e9286ff99ee88cfdeb2b748f730003a512190
- Linux stable commit 6f6064dab4dcfb7e34a395040a0c9dc22cc8765d
- Linux stable commit 7a58d4c4cf8ff60ab1f93399deefaf6057da91c7
- Linux stable commit 36cef585e2a31e4ddf33a004b0584a7a572246de
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22028 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a505075730d23ccc19fc4ac382a0ed73b630c057CVE reference, Linux
- https://git.kernel.org/stable/c/845e9286ff99ee88cfdeb2b748f730003a512190CVE reference, Linux
- https://git.kernel.org/stable/c/6f6064dab4dcfb7e34a395040a0c9dc22cc8765dCVE reference, Linux
- https://git.kernel.org/stable/c/7a58d4c4cf8ff60ab1f93399deefaf6057da91c7CVE reference, Linux
- https://git.kernel.org/stable/c/36cef585e2a31e4ddf33a004b0584a7a572246deCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.