What’s Vulnerable › Vulnerabilities

CVE-2025-38225: media: imx-jpeg: Cleanup after an allocation error

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-04 · updated 2026-06-17
• Weakness: CWE-908

Description

In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Cleanup after an allocation error When allocation failures are not cleaned up by the driver, further allocation errors will be false-positives, which will cause buffers to remain uninitialized and cause NULL pointer dereferences. Ensure proper cleanup of failed allocations to prevent these issues.

Affected products

• Debian Linux: 11.0
• Linux kernel: from 5.13 before 6.1.143; from 6.2 before 6.6.95; from 6.7 before 6.12.35; from 6.13 before 6.15.4 — fixed in 6.1.143, 6.12.35, 6.15.4, 6.6.95

How to fix

Upgrade to a fixed version: Linux kernel 6.1.143, 6.12.35, 6.15.4, 6.6.95. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0ee9469f818a0b4de3c0e7aecd733c103820d181
• https://git.kernel.org/stable/c/6d0efe7d35c75394f32ff9d0650a007642d23857
• https://git.kernel.org/stable/c/7500bb9cf164edbb2c8117d57620227b1a4a8369
• https://git.kernel.org/stable/c/b89ff9cf37ff59399f850d5f7781ef78fc37679f
• https://git.kernel.org/stable/c/ec26be7d6355a05552a0d0c1e73031f83aa4dc7f
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Get alerted when CVE-2025-38225 or the next vulnerability affects your stack