CVE-2025-37971: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37971 is a vulnerability discovered in the Linux kernel's bcm2835-camera staging driver, disclosed on May 20, 2025. The issue stems from an uninitialized device pointer in the v4l2_dev component, introduced by commit 42a2f6664e18 which modified the mmal_init function to pass an uninitialized dev->v4l2_dev.dev to vchiq_mmal_init (NVD, Wiz).

The vulnerability occurs when the mmal_init function attempts to pass dev->v4l2_dev.dev to vchiq_mmal_init, but dev->v4l2_dev was never properly initialized, resulting in a NULL pointer dereference. The issue has been assigned a CVSS 3.1 score of 7.0 with vector string AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (RedHat).

The vulnerability can lead to a NULL pointer dereference in the Linux kernel's bcm2835-camera driver, potentially resulting in system crashes or denial of service conditions (Wiz).

The vulnerability has been resolved by initializing dev->v4l2_dev.dev during the bcm2835_mmal_probe process. While the device pointer could be passed into v4l2_device_register to set it, this approach would require additional changes due to other effects (NVD).