Sizing CVE-2025-38680 Exposure: What 18.2 Million Linux SSH Hosts Do and Do Not Tell You
Vulnerability overview
CVE-2025-38680 is a Linux kernel out-of-bounds read in the USB Video Class driver, in uvc_parse_format(). NVD assigns CVSS 3.1 base 7.1 (HIGH) and classifies the weakness as CWE-125. The record was published on 4 September 2025. This article is about measurement, not about the flaw's mechanics.
Mechanism and exploitation conditions
The guard required buflen > 2 before a read of buffer[3], producing a one-byte over-read on a three-byte buffer. Because the descriptor arrives through a USB video device, NVD records an attack vector of LOCAL with low complexity and low privileges required. That locality is what makes naive exposure counting misleading: there is no service to count.
Impact
Confidentiality and availability impact are rated HIGH and integrity impact NONE. The mitigation advice that follows from a local trigger is about which devices and virtual machines are allowed to reach the driver, not about closing a network port.
Affected products and scope
The introducing commit is c0efd232929c2cd87238de2cccdaf4e845be5b0c. The CNA marks 2.6.26 and later as affected, naming fixes at 5.4.297, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.43, 6.15.11 and 6.16.2. NVD's CPE ranges start at 2.6.27 and include Debian 11.
Exposure context
Three ZoomEye queries were run for this article. The CVE-indexed query vul.cve="CVE-2025-38680" returned 0, which means ZoomEye holds no asset records tied to this identifier. The product probe app="Linux Kernel" returned 14, a small fingerprint population. The platform probe os="Linux" && port="22" returned 18,182,408.
Only the last number is large, and its meaning is narrow. It counts Linux hosts with an indexed SSH service. It does not count kernels, it does not test versions, and it says nothing about whether a camera device can reach the driver. The first two numbers must not be inverted into "only 14 hosts affected"; a small fingerprint population reflects how ZoomEye classifies assets, not the size of the vulnerable population.
The honest conclusion is that internet measurement cannot size this vulnerability. An internal inventory that records kernel branch, installed package version and device-passing policy can.
Remediation and mitigations
Patch to the fixed release for your branch and reboot, then record the result in the same inventory that tracks device policy. Where the driver is not needed, remove it, which makes the exposure question moot.
References
- CVE.org record: https://www.cve.org/CVERecord?id=CVE-2025-38680
- NVD record: https://nvd.nist.gov/vuln/detail/CVE-2025-38680
- ZoomEye search: https://www.zoomeye.ai/searchResult?q=b3M9IkxpbnV4IiAmJiBwb3J0PSIyMiI%3D
- CERT-BUND advisory WID-SEC-2025-1976: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1976
