Login Sign Up

CVE-2025-38540

5.5 MEDIUM

📋 TL;DR

Two specific Chicony Electronics HP 5MP camera models (USB IDs 04F2:B824 and 04F2:B82C) expose a non-functional HID sensor interface in the Linux kernel. When userspace applications attempt to access this interface via iio_info, the system hangs due to runtime power management trying to wake an unresponsive sensor. This affects Linux systems with these specific USB cameras connected.

💻 Affected Systems

Products:
  • Linux kernel
Versions: All versions before the fix commits (specific commit hashes provided in references)
Operating Systems: Linux distributions using affected kernel versions
Default Config Vulnerable: ⚠️ Yes
Notes: Only vulnerable when the specific Chicony Electronics HP 5MP cameras (USB IDs 04F2:B824 and 04F2:B82C) are connected to the system.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

System becomes completely unresponsive (hangs) requiring hard reboot, potentially causing service disruption or data loss.

🟠

Likely Case

System hangs when userspace applications (like monitoring tools) attempt to access the non-functional sensor interface, requiring manual intervention.

🟢

If Mitigated

No impact if the devices are not connected or the kernel patch is applied.

🌐 Internet-Facing: LOW - This requires physical USB device connection or USB passthrough, not network accessible.
🏢 Internal Only: MEDIUM - Internal users with these specific USB cameras could trigger system hangs.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation requires physical access to connect the vulnerable USB device or USB passthrough capability. Userspace application must attempt to access the sensor interface.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 1b297ab6f38ca60a4ca7298b297944ec6043b2f4, 2b0931eee48208c25bb77486946dea8e96aa6a36, 35f1a5360ac68d9629abbb3930a0a07901cba296, 3ce1d87d1f5d80322757aa917182deb7370963b9, 54bae4c17c11688339eb73a04fd24203bb6e7494

Vendor Advisory: https://git.kernel.org/stable/c/

Restart Required: No

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For enterprise distributions, apply vendor-provided kernel security updates. 3. Rebuild kernel if compiling from source with the fix commits included.

🔧 Temporary Workarounds

USB Device Blocking

all

Block the vulnerable USB devices using udev rules to prevent them from being recognized by the kernel.

echo 'SUBSYSTEM=="usb", ATTR{idVendor}=="04f2", ATTR{idProduct}=="b824", ATTR{authorized}="0"' > /etc/udev/rules.d/99-block-chicony.rules
echo 'SUBSYSTEM=="usb", ATTR{idVendor}=="04f2", ATTR{idProduct}=="b82c", ATTR{authorized}="0"' >> /etc/udev/rules.d/99-block-chicony.rules
udevadm control --reload-rules && udevadm trigger

🧯 If You Can't Patch

  • Physically disconnect or do not connect the affected Chicony Electronics HP 5MP cameras (USB IDs 04F2:B824 and 04F2:B82C).
  • Implement strict USB device control policies to prevent unauthorized USB devices from being connected to systems.

🔍 How to Verify

Check if Vulnerable:

Check if affected USB devices are connected: lsusb | grep -i '04f2:b824\|04f2:b82c'

Check Version:

uname -r

Verify Fix Applied:

Check kernel version includes fix commits: grep -q 'HID.*quirks.*Chicony' /proc/version || echo 'Check kernel changelog for fix commits'

📡 Detection & Monitoring

Log Indicators:

  • Kernel logs showing USB device connection of vendor 04f2, product b824 or b82c
  • System hang/crash logs when USB camera is connected
  • dmesg entries related to HID sensor or iio_info access

Network Indicators:

  • None - this is a local USB device issue

SIEM Query:

source="kernel" AND ("04f2:b824" OR "04f2:b82c" OR "Chicony" OR "HP 5MP")

📊 Metadata

CVE ID: CVE-2025-38540
CVSS v3 Score: 5.5 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score: 0.01% exploit probability (2.3th percentile)
Published: August 16, 2025
Last Updated: January 22, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON