Skip to main content

Linux Kernel CVE-2025-68175

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.6 MEDIUM

Local access to the video device needed (AV:L, PR:L); demonstrated impact is a driver crash/DoS (A:H) with only speculative, unproven memory-corruption giving limited C/I.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 07:42 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 07:42 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Analysis Generated
Apr 02, 2026 - 12:22 vuln.today
CVE Published
Dec 16, 2025 - 14:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: nxp: imx8-isi: Fix streaming cleanup on release

The current implementation unconditionally calls mxc_isi_video_cleanup_streaming() in mxc_isi_video_release(). This can lead to situations where any release call (like from a simple "v4l2-ctl -l") may release a currently streaming queue when called on such a device.

This is reproducible on an i.MX8MP board by streaming from an ISI capture device using gstreamer:

gst-launch-1.0 -v v4l2src device=/dev/videoX ! \ video/x-raw,format=GRAY8,width=1280,height=800,framerate=1/120 ! \ fakesink

While this stream is running, querying the caps of the same device provokes the error state:

v4l2-ctl -l -d /dev/videoX

This results in the following trace:

[ 155.452152] ------------[ cut here ]------------ [ 155.452163] WARNING: CPU: 0 PID: 1708 at drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c:713 mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi] [ 157.004248] Modules linked in: cfg80211 rpmsg_ctrl rpmsg_char rpmsg_tty virtio_rpmsg_bus rpmsg_ns rpmsg_core rfkill nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables mcp251x6 [ 157.053499] CPU: 0 UID: 0 PID: 1708 Comm: python3 Not tainted 6.15.4-00114-g1f61ca5cad76 #1 PREEMPT [ 157.064369] Hardware name: imx8mp_board_01 (DT) [ 157.068205] pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 157.075169] pc : mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi] [ 157.081195] lr : mxc_isi_pipe_irq_handler+0x38/0x1b0 [imx8_isi] [ 157.087126] sp : ffff800080003ee0 [ 157.090438] x29: ffff800080003ee0 x28: ffff0000c3688000 x27: 0000000000000000 [ 157.097580] x26: 0000000000000000 x25: ffff0000c1e7ac00 x24: ffff800081b5ad50 [ 157.104723] x23: 00000000000000d1 x22: 0000000000000000 x21: ffff0000c25e4000 [ 157.111866] x20: 0000000060000200 x19: ffff80007a0608d0 x18: 0000000000000000 [ 157.119008] x17: ffff80006a4e3000 x16: ffff800080000000 x15: 0000000000000000 [ 157.126146] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 157.133287] x11: 0000000000000040 x10: ffff0000c01445f0 x9 : ffff80007a053a38 [ 157.140425] x8 : ffff0000c04004b8 x7 : 0000000000000000 x6 : 0000000000000000 [ 157.147567] x5 : ffff0000c0400490 x4 : ffff80006a4e3000 x3 : ffff0000c25e4000 [ 157.154706] x2 : 0000000000000000 x1 : ffff8000825c0014 x0 : 0000000060000200 [ 157.161850] Call trace: [ 157.164296] mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi] (P) [ 157.170319] __handle_irq_event_percpu+0x58/0x218 [ 157.175029] handle_irq_event+0x54/0xb8 [ 157.178867] handle_fasteoi_irq+0xac/0x248 [ 157.182968] handle_irq_desc+0x48/0x68 [ 157.186723] generic_handle_domain_irq+0x24/0x38 [ 157.191346] gic_handle_irq+0x54/0x120 [ 157.195098] call_on_irq_stack+0x24/0x30 [ 157.199027] do_interrupt_handler+0x88/0x98 [ 157.203212] el0_interrupt+0x44/0xc0 [ 157.206792] __el0_irq_handler_common+0x18/0x28 [ 157.211328] el0t_64_irq_handler+0x10/0x20 [ 157.215429] el0t_64_irq+0x198/0x1a0 [ 157.219009] ---[ end trace 0000000000000000 ]---

Address this issue by moving the streaming preparation and cleanup to the vb2 .prepare_streaming() and .unprepare_streaming() operations. This also simplifies the driver by allowing direct usage of the vb2_ioctl_streamon() and vb2_ioctl_streamoff() helpers, and removal of the manual cleanup from mxc_isi_video_release().

AnalysisAI

Local denial-of-service (and potential memory corruption) in the Linux kernel's NXP i.MX8 ISI media capture driver (imx8-isi) allows a low-privileged user with access to an ISI /dev/videoX device to trigger a WARNING and driver error state by simply querying device controls while a capture stream is active. The flaw stems from mxc_isi_video_release() unconditionally tearing down streaming state, so any release call (e.g. from v4l2-ctl -l) can free a queue that is still streaming. No public exploit is identified at time of analysis and EPSS risk is negligible (0.03%), though a deterministic crash-reproduction recipe is published in the fix commit.

Technical ContextAI

The affected component is the Video4Linux2 (V4L2) capture driver for the Image Sensing Interface (ISI) block on NXP i.MX8-family SoCs (drivers/media/platform/nxp/imx8-isi). Video capture in V4L2 uses the videobuf2 (vb2) framework to manage streaming buffer queues. The bug is a resource-lifecycle / incomplete-cleanup defect (conceptually CWE-459 improper resource shutdown, with use-after-free/CWE-416 characteristics): the driver's release path called mxc_isi_video_cleanup_streaming() unconditionally rather than tying stream setup/teardown to the queue's actual streaming state. As a result, a release on an open file handle (even one not doing streaming) tears down streaming resources still in use by an active stream, so the interrupt handler (mxc_isi_pipe_irq_handler) subsequently operates on freed/invalid state and hits a WARN at imx8-isi-pipe.c:713. The upstream fix moves setup/teardown into the vb2 .prepare_streaming()/.unprepare_streaming() operations and switches to the standard vb2_ioctl_streamon/streamoff helpers, removing the manual cleanup from release. CWE is not assigned in the source data.

Affected ProductsAI

The Linux kernel's imx8-isi media capture driver on NXP i.MX8-series SoCs is affected, as demonstrated on an i.MX8MP board running kernel 6.15.4 (build 6.15.4-00114-g1f61ca5cad76). The specific fixed kernel versions/tags are not enumerated in the source data; the fix is delivered via three stable-tree commits (git.kernel.org/stable/c/029914306b93b37c6e7060793d2b6f76b935cfa6, .../47773031a148ad7973b809cc7723cba77eda2b42, and .../a2008925ed7361d69f92f63f0a779c300432610a). No CPE strings were provided. Distribution-packaged fixes are tracked for Ubuntu via advisory USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1). Only systems that actually load the imx8-isi driver - i.MX8/8MP-based hardware doing ISI video capture - are exposed.

RemediationAI

Apply the upstream kernel fix, which is available as stable-tree commits (git.kernel.org/stable/c/029914306b93b37c6e7060793d2b6f76b935cfa6, 47773031a148ad7973b809cc7723cba77eda2b42, a2008925ed7361d69f92f63f0a779c300432610a); a released patched version number is not independently confirmed in the source data, so pull the fix through your distribution or kernel maintainer. Ubuntu users should update to the kernel packages listed in USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1). If patching must be deferred, the practical compensating control is to restrict access to the ISI capture devices: tighten permissions/ownership on /dev/video* nodes and remove untrusted local users from the 'video' group so only trusted processes can open the ISI device concurrently - the trade-off is that legitimate non-root capture applications may lose access. On systems that do not need ISI capture, unloading or blacklisting the imx8_isi module eliminates exposure entirely at the cost of disabling that camera pipeline.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2025-68175 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy