Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s virtual digital-TV test driver can access memory after it has been freed when initialization fails. A local, low-privileged user reaching this driver could potentially crash the system or compromise kernel confidentiality and integrity. The specialized driver limits typical exposure, but affected systems should receive the corrected kernel.
Executive priority
Treat this as a high-priority kernel maintenance issue on multi-user, development, testing, and shared-host systems with vidtv exposure. Prioritize by actual driver availability rather than broad internet exposure. Standard enterprise systems without the test driver may have materially lower practical risk, but that should be verified rather than assumed.
Technical view
vidtv_mux_init continues after service-information initialization fails, then accesses the freed si object through vidtv_mux_pid_ctx_init. KASAN reproduced the slab use-after-free. The correction exits the initialization path after failure. The supplied CVSS 3.1 score is 7.8 with local access, low complexity, low privileges, no user interaction, and high potential impact.
Likely exposure
Exposure requires an affected Linux kernel and a reachable vidtv media test-driver path. Internet-facing services are not directly implicated because the supplied vector is local. Risk is more relevant where untrusted local users or workloads can access the driver. Exact exposure requires matching deployed kernels against vendor backports and configuration.
Exploitation context
The source bundle provides a syzbot/KASAN crash reproduction and marks the CVE absent from KEV. It does not provide evidence of active exploitation, a public weaponized exploit, or remote reachability. Memory-corruption impact may be serious, but practical exploitation beyond the reported use-after-free is not established by these sources.
Researcher notes
The reported fault is an eight-byte read in vidtv_mux_pid_ctx_init, reached from vidtv_mux_init after PSI/SI initialization failure. Allocation and freeing occur in the vidtv PSI initialization and cleanup paths. The supplied record lists multiple stable-kernel commits, indicating branch-specific fixes; verify downstream backports rather than relying only on version strings.
Mitigation direction
- Apply a vendor-supported kernel update containing the referenced stable fix or distribution backport.
- Prioritize shared systems where untrusted local users or workloads can access media devices.
- If immediate patching is unavailable, ask the vendor whether disabling vidtv is an appropriate temporary control.
- Reboot into the corrected kernel after installation, following normal change-control procedures.
Validation and detection
- Inventory running kernel builds and compare them with vendor CVE advisories and backport information.
- Determine whether the vidtv test driver is built, loadable, loaded, or exposed to untrusted workloads.
- Confirm the installed kernel contains the referenced correction or an equivalent vendor backport.
- After reboot, verify systems are running the intended corrected kernel rather than an older installed build.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38227 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e1d72ff111eceea6b28dccb7ca4e8f4900b11729CVE reference, Linux
- https://git.kernel.org/stable/c/7e62be1f3b241bc9faee547864bb39332955509bCVE reference, Linux
- https://git.kernel.org/stable/c/685c18bc5a36f823ee725e85aac1303ef5f535baCVE reference, Linux
- https://git.kernel.org/stable/c/9824e1732a163e005aa84e12ec439493ebd4f097CVE reference, Linux
- https://git.kernel.org/stable/c/72541cae73d0809a6416bfcd2ee6473046a0013aCVE reference, Linux
- https://git.kernel.org/stable/c/f8c2483be6e8bb6c2148315b4a924c65bb442b5eCVE reference, Linux
- https://git.kernel.org/stable/c/1d5f88f053480326873115092bc116b7d14916baCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.