CVE-2025-40016

A vulnerability exists in the Linux kernel’s UVC (USB Video Class) video driver (uvcvideo) related to how media entity identifiers are processed. According to the UVC 1.1+ specification, each unit and terminal must have a non-zero, unique ID. In certain cases, when an entity is assigned an ID of 0 or a duplicate ID, the driver did not correctly mark it as invalid, potentially leading to incorrect entity lookups and a malformed internal representation of the media device topology.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the uvcvideo kernel module from loading if USB video devices are not required. Create /etc/modprobe.d/blacklist-uvcvideo.conf with blacklist uvcvideo. Regenerate the initramfs using dracut -f -v and reboot the system. This action may impact functionality dependent on USB video devices.