LiveActive security incident?Get immediate response
CVE Record

CVE-2025-22078: staging: vchiq_arm: Fix possible NPR of keep-alive thread

In the Linux kernel, the following vulnerability has been resolved: staging: vchiq_arm: Fix possible NPR of keep-alive thread In case vchiq_platform_conn_state_changed() is never called or fails before driver removal, ka_thread won't be a valid pointer to a task_struct. So do the necessary checks before calling kthread_stop to avoid a crash.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-22078 is a Linux kernel crash bug in the staging vchiq_arm driver. If a keep-alive thread was never created correctly, driver removal could try to stop an invalid thread pointer and crash the system. The sources do not provide a CVSS score or evidence of active exploitation.

Executive priority

Treat as a targeted stability issue unless your environment depends on this driver. Patch through normal kernel maintenance, with faster handling for exposed systems where a crash would affect availability or service commitments.

Technical view

The bug is in staging/vchiq_arm keep-alive thread handling. If vchiq_platform_conn_state_changed() is never called, or fails before driver removal, ka_thread may not be a valid task_struct pointer. The resolved fix adds checks before kthread_stop to avoid a crash.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with the staging vchiq_arm driver present and relevant code paths reachable. The bundle lists Linux 6.11, 6.12.23, 6.13.11, 6.14.2, and 6.15 as affected, but distribution backports may differ.

Exploitation context

The source bundle marks KEV as false and provides no cited evidence of active exploitation or public weaponization. The described impact is a crash during driver removal after failed or missing connection-state initialization, not data theft or remote code execution.

Researcher notes

Evidence is narrow: the CVE text identifies a NULL or invalid pointer crash risk and references stable kernel commits. No CVSS, CWE, exploitability detail, privilege requirement, or attack vector is provided in the bundle.

Mitigation direction

  • Update to a vendor or distribution kernel containing the referenced stable fixes.
  • Check Linux distribution advisories for backported fix status.
  • Prioritize systems that load the vchiq_arm staging driver.
  • Where safe, avoid using the affected driver until patched.

Validation and detection

  • Inventory kernel versions across Linux assets.
  • Confirm whether vchiq_arm is built, packaged, or loaded.
  • Compare installed kernel changelogs against the referenced stable commits.
  • Review crash reports for driver removal or kthread_stop failures.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-22078 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux863a756aaf49ed23d25bbb1dad999a85f09e1836, 863a756aaf49ed23d25bbb1dad999a85f09e1836, 863a756aaf49ed23d25bbb1dad999a85f09e1836, 863a756aaf49ed23d25bbb1dad999a85f09e1836unaffected
LinuxLinux6.11, 0, 6.12.23, 6.13.11, 6.14.2, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.