Sizing CVE-2025-38680: 18.2M Linux SSH Hosts Don't Reflect Real Exposure

CVE-2025-38680 is an out-of-bounds read in the Linux kernel's USB Video Class driver (CVSS 7.1), fixed in branches from 5.4.297 to 6.16.2. A ZoomEye query for Linux SSH hosts returned 18.2 million, but the flaw is local and cannot be sized by internet scanning.

• CVE-2025-38680: one-byte over-read in uvc_parse_format(), CVSS 7.1
• Fixes in 5.4.297, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.43, 6.15.11, 6.16.2
• ZoomEye CVE query returned 0 records; app="Linux Kernel" returned 14
• Internet measurement can't size a local flaw; internal kernel inventory can