GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38619 (GCVE-0-2025-38619)

Vulnerability from cvelistv5 – Published: 2025-08-22 16:00 – Updated: 2026-08-05 12:03
VLAI
Title
media: ti: j721e-csi2rx: fix list_del corruption
Summary
In the Linux kernel, the following vulnerability has been resolved: media: ti: j721e-csi2rx: fix list_del corruption If ti_csi2rx_start_dma() fails in ti_csi2rx_dma_callback(), the buffer is marked done with VB2_BUF_STATE_ERROR but is not removed from the DMA queue. This causes the same buffer to be retried in the next iteration, resulting in a double list_del() and eventual list corruption. Fix this by removing the buffer from the queue before calling vb2_buffer_done() on error. This resolves a crash due to list_del corruption: [ 37.811243] j721e-csi2rx 30102000.ticsi2rx: Failed to queue the next buffer for DMA [ 37.832187] slab kmalloc-2k start ffff00000255b000 pointer offset 1064 size 2048 [ 37.839761] list_del corruption. next->prev should be ffff00000255bc28, but was ffff00000255d428. (next=ffff00000255b428) [ 37.850799] ------------[ cut here ]------------ [ 37.855424] kernel BUG at lib/list_debug.c:65! [ 37.859876] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 37.866061] Modules linked in: i2c_dev usb_f_rndis u_ether libcomposite dwc3 udc_core usb_common aes_ce_blk aes_ce_cipher ghash_ce gf128mul sha1_ce cpufreq_dt dwc3_am62 phy_gmii_sel sa2ul [ 37.882830] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc3+ #28 VOLUNTARY [ 37.890851] Hardware name: Bosch STLA-GSRV2-B0 (DT) [ 37.895737] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 37.902703] pc : __list_del_entry_valid_or_report+0xdc/0x114 [ 37.908390] lr : __list_del_entry_valid_or_report+0xdc/0x114 [ 37.914059] sp : ffff800080003db0 [ 37.917375] x29: ffff800080003db0 x28: 0000000000000007 x27: ffff800080e50000 [ 37.924521] x26: 0000000000000000 x25: ffff0000016abb50 x24: dead000000000122 [ 37.931666] x23: ffff0000016abb78 x22: ffff0000016ab080 x21: ffff800080003de0 [ 37.938810] x20: ffff00000255bc00 x19: ffff00000255b800 x18: 000000000000000a [ 37.945956] x17: 20747562202c3832 x16: 6362353532303030 x15: 0720072007200720 [ 37.953101] x14: 0720072007200720 x13: 0720072007200720 x12: 00000000ffffffea [ 37.960248] x11: ffff800080003b18 x10: 00000000ffffefff x9 : ffff800080f5b568 [ 37.967396] x8 : ffff800080f5b5c0 x7 : 0000000000017fe8 x6 : c0000000ffffefff [ 37.974542] x5 : ffff00000fea6688 x4 : 0000000000000000 x3 : 0000000000000000 [ 37.981686] x2 : 0000000000000000 x1 : ffff800080ef2b40 x0 : 000000000000006d [ 37.988832] Call trace: [ 37.991281] __list_del_entry_valid_or_report+0xdc/0x114 (P) [ 37.996959] ti_csi2rx_dma_callback+0x84/0x1c4 [ 38.001419] udma_vchan_complete+0x1e0/0x344 [ 38.005705] tasklet_action_common+0x118/0x310 [ 38.010163] tasklet_action+0x30/0x3c [ 38.013832] handle_softirqs+0x10c/0x2e0 [ 38.017761] __do_softirq+0x14/0x20 [ 38.021256] ____do_softirq+0x10/0x20 [ 38.024931] call_on_irq_stack+0x24/0x60 [ 38.028873] do_softirq_own_stack+0x1c/0x40 [ 38.033064] __irq_exit_rcu+0x130/0x15c [ 38.036909] irq_exit_rcu+0x10/0x20 [ 38.040403] el1_interrupt+0x38/0x60 [ 38.043987] el1h_64_irq_handler+0x18/0x24 [ 38.048091] el1h_64_irq+0x6c/0x70 [ 38.051501] default_idle_call+0x34/0xe0 (P) [ 38.055783] do_idle+0x1f8/0x250 [ 38.059021] cpu_startup_entry+0x34/0x3c [ 38.062951] rest_init+0xb4/0xc0 [ 38.066186] console_on_rootfs+0x0/0x6c [ 38.070031] __primary_switched+0x88/0x90 [ 38.074059] Code: b00037e0 91378000 f9400462 97e9bf49 (d4210000) [ 38.080168] ---[ end trace 0000000000000000 ]--- [ 38.084795] Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt [ 38.092197] SMP: stopping secondary CPUs [ 38.096139] Kernel Offset: disabled [ 38.099631] CPU features: 0x0000,00002000,02000801,0400420b [ 38.105202] Memory Limit: none [ 38.108260] ---[ end Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt ]---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b4a3d877dc92963a4db16ddb71df3d333c0d40bd , < 68e5579f4de12207b23c41b44a4c0778b6c2858f (git)
Affected: b4a3d877dc92963a4db16ddb71df3d333c0d40bd , < 92d0188f36ca8082af7989d743eb5b44c2d259f7 (git)
Affected: b4a3d877dc92963a4db16ddb71df3d333c0d40bd , < a4a8cb0889927d59ebd839458c8f038bc5298ef9 (git)
Affected: b4a3d877dc92963a4db16ddb71df3d333c0d40bd , < ae42c6fe531425ef2f47e82f96851427d24bbf6b (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.12.42 , ≤ 6.12.* (semver)
Unaffected: 6.15.10 , ≤ 6.15.* (semver)
Unaffected: 6.16.1 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "68e5579f4de12207b23c41b44a4c0778b6c2858f",
              "status": "affected",
              "version": "b4a3d877dc92963a4db16ddb71df3d333c0d40bd",
              "versionType": "git"
            },
            {
              "lessThan": "92d0188f36ca8082af7989d743eb5b44c2d259f7",
              "status": "affected",
              "version": "b4a3d877dc92963a4db16ddb71df3d333c0d40bd",
              "versionType": "git"
            },
            {
              "lessThan": "a4a8cb0889927d59ebd839458c8f038bc5298ef9",
              "status": "affected",
              "version": "b4a3d877dc92963a4db16ddb71df3d333c0d40bd",
              "versionType": "git"
            },
            {
              "lessThan": "ae42c6fe531425ef2f47e82f96851427d24bbf6b",
              "status": "affected",
              "version": "b4a3d877dc92963a4db16ddb71df3d333c0d40bd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ti: j721e-csi2rx: fix list_del corruption\n\nIf ti_csi2rx_start_dma() fails in ti_csi2rx_dma_callback(), the buffer is\nmarked done with VB2_BUF_STATE_ERROR but is not removed from the DMA queue.\nThis causes the same buffer to be retried in the next iteration, resulting\nin a double list_del() and eventual list corruption.\n\nFix this by removing the buffer from the queue before calling\nvb2_buffer_done() on error.\n\nThis resolves a crash due to list_del corruption:\n[   37.811243] j721e-csi2rx 30102000.ticsi2rx: Failed to queue the next buffer for DMA\n[   37.832187]  slab kmalloc-2k start ffff00000255b000 pointer offset 1064 size 2048\n[   37.839761] list_del corruption. next-\u003eprev should be ffff00000255bc28, but was ffff00000255d428. (next=ffff00000255b428)\n[   37.850799] ------------[ cut here ]------------\n[   37.855424] kernel BUG at lib/list_debug.c:65!\n[   37.859876] Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP\n[   37.866061] Modules linked in: i2c_dev usb_f_rndis u_ether libcomposite dwc3 udc_core usb_common aes_ce_blk aes_ce_cipher ghash_ce gf128mul sha1_ce cpufreq_dt dwc3_am62 phy_gmii_sel sa2ul\n[   37.882830] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc3+ #28 VOLUNTARY\n[   37.890851] Hardware name: Bosch STLA-GSRV2-B0 (DT)\n[   37.895737] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[   37.902703] pc : __list_del_entry_valid_or_report+0xdc/0x114\n[   37.908390] lr : __list_del_entry_valid_or_report+0xdc/0x114\n[   37.914059] sp : ffff800080003db0\n[   37.917375] x29: ffff800080003db0 x28: 0000000000000007 x27: ffff800080e50000\n[   37.924521] x26: 0000000000000000 x25: ffff0000016abb50 x24: dead000000000122\n[   37.931666] x23: ffff0000016abb78 x22: ffff0000016ab080 x21: ffff800080003de0\n[   37.938810] x20: ffff00000255bc00 x19: ffff00000255b800 x18: 000000000000000a\n[   37.945956] x17: 20747562202c3832 x16: 6362353532303030 x15: 0720072007200720\n[   37.953101] x14: 0720072007200720 x13: 0720072007200720 x12: 00000000ffffffea\n[   37.960248] x11: ffff800080003b18 x10: 00000000ffffefff x9 : ffff800080f5b568\n[   37.967396] x8 : ffff800080f5b5c0 x7 : 0000000000017fe8 x6 : c0000000ffffefff\n[   37.974542] x5 : ffff00000fea6688 x4 : 0000000000000000 x3 : 0000000000000000\n[   37.981686] x2 : 0000000000000000 x1 : ffff800080ef2b40 x0 : 000000000000006d\n[   37.988832] Call trace:\n[   37.991281]  __list_del_entry_valid_or_report+0xdc/0x114 (P)\n[   37.996959]  ti_csi2rx_dma_callback+0x84/0x1c4\n[   38.001419]  udma_vchan_complete+0x1e0/0x344\n[   38.005705]  tasklet_action_common+0x118/0x310\n[   38.010163]  tasklet_action+0x30/0x3c\n[   38.013832]  handle_softirqs+0x10c/0x2e0\n[   38.017761]  __do_softirq+0x14/0x20\n[   38.021256]  ____do_softirq+0x10/0x20\n[   38.024931]  call_on_irq_stack+0x24/0x60\n[   38.028873]  do_softirq_own_stack+0x1c/0x40\n[   38.033064]  __irq_exit_rcu+0x130/0x15c\n[   38.036909]  irq_exit_rcu+0x10/0x20\n[   38.040403]  el1_interrupt+0x38/0x60\n[   38.043987]  el1h_64_irq_handler+0x18/0x24\n[   38.048091]  el1h_64_irq+0x6c/0x70\n[   38.051501]  default_idle_call+0x34/0xe0 (P)\n[   38.055783]  do_idle+0x1f8/0x250\n[   38.059021]  cpu_startup_entry+0x34/0x3c\n[   38.062951]  rest_init+0xb4/0xc0\n[   38.066186]  console_on_rootfs+0x0/0x6c\n[   38.070031]  __primary_switched+0x88/0x90\n[   38.074059] Code: b00037e0 91378000 f9400462 97e9bf49 (d4210000)\n[   38.080168] ---[ end trace 0000000000000000 ]---\n[   38.084795] Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt\n[   38.092197] SMP: stopping secondary CPUs\n[   38.096139] Kernel Offset: disabled\n[   38.099631] CPU features: 0x0000,00002000,02000801,0400420b\n[   38.105202] Memory Limit: none\n[   38.108260] ---[ end Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt ]---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through V4L2 ioctls (REQBUFS/QBUF/STREAMON) on the local `/dev/videoN` node exported by the TI J721E/AM62 CSI-2 receiver; no network or physical interaction is needed since the triggering error path is driven by local memory pressure, not by the camera link.\nAC:L - The required `ti_csi2rx_start_dma()` failure stems from `GFP_NOWAIT` descriptor allocations in k3-udma that fail readily under memory pressure an unprivileged process can generate, and the attacker also controls the number of concurrently submitted descriptors via the user-chosen buffer count, so the error path can be provoked repeatedly and reliably.\nPR:L - Only access to the video device node (typically the `video` group on embedded/automotive Linux, or a camera-capable app sandbox on Android) plus ordinary streaming ioctls is needed; no capability check such as CAP_SYS_ADMIN exists anywhere along the path.\nUI:N - The attacking process performs every step itself \u2014 opening the device, allocating and queueing buffers, starting the stream, and applying memory pressure \u2014 with no action from any other user.\nS:U - The corrupted list heads and vb2 buffer structures live entirely within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The cross-linked `queue`/`submitted` lists cause traversal through stale nodes in reused kmalloc-2k slab memory, and a buffer released to userspace remains an active DMA target, so the corruption is leverageable to read kernel memory contents adjacent to or reallocated over the freed buffer.\nI:H - Double `list_del()`/`list_add()` on an already-linked node performs unlink writes of pointer values into freed and reallocated slab objects, and the DMA engine writes into a buffer vb2 has already handed back \u2014 a heap-groomable write primitive suitable for control-flow hijacking.\nA:H - The reported crash is a `BUG()` in `__list_del_entry_valid_or_report()` taken from a tasklet, which is a fatal exception in interrupt context and panics the machine outright; the persistent-failure variant instead spins forever holding `dma-\u003elock` with IRQs disabled, hanging the CPU."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:35.052Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/68e5579f4de12207b23c41b44a4c0778b6c2858f"
        },
        {
          "url": "https://git.kernel.org/stable/c/92d0188f36ca8082af7989d743eb5b44c2d259f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4a8cb0889927d59ebd839458c8f038bc5298ef9"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae42c6fe531425ef2f47e82f96851427d24bbf6b"
        }
      ],
      "title": "media: ti: j721e-csi2rx: fix list_del corruption",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38619",
    "datePublished": "2025-08-22T16:00:23.564Z",
    "dateReserved": "2025-04-16T04:51:24.029Z",
    "dateUpdated": "2026-08-05T12:03:35.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38619",
      "date": "2026-09-16",
      "epss": "0.00169",
      "percentile": "0.06605"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38619\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-22T16:15:35.177\",\"lastModified\":\"2026-07-30T06:23:31.997\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: ti: j721e-csi2rx: fix list_del corruption\\n\\nIf ti_csi2rx_start_dma() fails in ti_csi2rx_dma_callback(), the buffer is\\nmarked done with VB2_BUF_STATE_ERROR but is not removed from the DMA queue.\\nThis causes the same buffer to be retried in the next iteration, resulting\\nin a double list_del() and eventual list corruption.\\n\\nFix this by removing the buffer from the queue before calling\\nvb2_buffer_done() on error.\\n\\nThis resolves a crash due to list_del corruption:\\n[   37.811243] j721e-csi2rx 30102000.ticsi2rx: Failed to queue the next buffer for DMA\\n[   37.832187]  slab kmalloc-2k start ffff00000255b000 pointer offset 1064 size 2048\\n[   37.839761] list_del corruption. next-\u003eprev should be ffff00000255bc28, but was ffff00000255d428. (next=ffff00000255b428)\\n[   37.850799] ------------[ cut here ]------------\\n[   37.855424] kernel BUG at lib/list_debug.c:65!\\n[   37.859876] Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP\\n[   37.866061] Modules linked in: i2c_dev usb_f_rndis u_ether libcomposite dwc3 udc_core usb_common aes_ce_blk aes_ce_cipher ghash_ce gf128mul sha1_ce cpufreq_dt dwc3_am62 phy_gmii_sel sa2ul\\n[   37.882830] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc3+ #28 VOLUNTARY\\n[   37.890851] Hardware name: Bosch STLA-GSRV2-B0 (DT)\\n[   37.895737] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n[   37.902703] pc : __list_del_entry_valid_or_report+0xdc/0x114\\n[   37.908390] lr : __list_del_entry_valid_or_report+0xdc/0x114\\n[   37.914059] sp : ffff800080003db0\\n[   37.917375] x29: ffff800080003db0 x28: 0000000000000007 x27: ffff800080e50000\\n[   37.924521] x26: 0000000000000000 x25: ffff0000016abb50 x24: dead000000000122\\n[   37.931666] x23: ffff0000016abb78 x22: ffff0000016ab080 x21: ffff800080003de0\\n[   37.938810] x20: ffff00000255bc00 x19: ffff00000255b800 x18: 000000000000000a\\n[   37.945956] x17: 20747562202c3832 x16: 6362353532303030 x15: 0720072007200720\\n[   37.953101] x14: 0720072007200720 x13: 0720072007200720 x12: 00000000ffffffea\\n[   37.960248] x11: ffff800080003b18 x10: 00000000ffffefff x9 : ffff800080f5b568\\n[   37.967396] x8 : ffff800080f5b5c0 x7 : 0000000000017fe8 x6 : c0000000ffffefff\\n[   37.974542] x5 : ffff00000fea6688 x4 : 0000000000000000 x3 : 0000000000000000\\n[   37.981686] x2 : 0000000000000000 x1 : ffff800080ef2b40 x0 : 000000000000006d\\n[   37.988832] Call trace:\\n[   37.991281]  __list_del_entry_valid_or_report+0xdc/0x114 (P)\\n[   37.996959]  ti_csi2rx_dma_callback+0x84/0x1c4\\n[   38.001419]  udma_vchan_complete+0x1e0/0x344\\n[   38.005705]  tasklet_action_common+0x118/0x310\\n[   38.010163]  tasklet_action+0x30/0x3c\\n[   38.013832]  handle_softirqs+0x10c/0x2e0\\n[   38.017761]  __do_softirq+0x14/0x20\\n[   38.021256]  ____do_softirq+0x10/0x20\\n[   38.024931]  call_on_irq_stack+0x24/0x60\\n[   38.028873]  do_softirq_own_stack+0x1c/0x40\\n[   38.033064]  __irq_exit_rcu+0x130/0x15c\\n[   38.036909]  irq_exit_rcu+0x10/0x20\\n[   38.040403]  el1_interrupt+0x38/0x60\\n[   38.043987]  el1h_64_irq_handler+0x18/0x24\\n[   38.048091]  el1h_64_irq+0x6c/0x70\\n[   38.051501]  default_idle_call+0x34/0xe0 (P)\\n[   38.055783]  do_idle+0x1f8/0x250\\n[   38.059021]  cpu_startup_entry+0x34/0x3c\\n[   38.062951]  rest_init+0xb4/0xc0\\n[   38.066186]  console_on_rootfs+0x0/0x6c\\n[   38.070031]  __primary_switched+0x88/0x90\\n[   38.074059] Code: b00037e0 91378000 f9400462 97e9bf49 (d4210000)\\n[   38.080168] ---[ end trace 0000000000000000 ]---\\n[   38.084795] Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt\\n[   38.092197] SMP: stopping secondary CPUs\\n[   38.096139] Kernel Offset: disabled\\n[   38.099631] CPU features: 0x0000,00002000,02000801,0400420b\\n[   38.105202] Memory Limit: none\\n[   38.108260] ---[ end Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt ]---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: ti: j721e-csi2rx: correcci\u00f3n de corrupci\u00f3n de list_del. Si ti_csi2rx_start_dma() falla en ti_csi2rx_dma_callback(), el b\u00fafer se marca como terminado con VB2_BUF_STATE_ERROR, pero no se elimina de la cola de DMA. Esto provoca que se vuelva a intentar el mismo b\u00fafer en la siguiente iteraci\u00f3n, lo que resulta en una doble iteraci\u00f3n de list_del() y, finalmente, en corrupci\u00f3n de la lista. Para solucionar esto, elimine el b\u00fafer de la cola antes de llamar a vb2_buffer_done() en caso de error. Esto resuelve un fallo debido a la corrupci\u00f3n de list_del: [ 37.811243] j721e-csi2rx 30102000.ticsi2rx: Failed to queue the next buffer for DMA [ 37.832187] slab kmalloc-2k start ffff00000255b000 pointer offset 1064 size 2048 [ 37.839761] list_del corruption. next-\u0026gt;prev should be ffff00000255bc28, but was ffff00000255d428. (next=ffff00000255b428) [ 37.850799] ------------[ cut here ]------------ [ 37.855424] kernel BUG at lib/list_debug.c:65! [ 37.859876] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 37.866061] Modules linked in: i2c_dev usb_f_rndis u_ether libcomposite dwc3 udc_core usb_common aes_ce_blk aes_ce_cipher ghash_ce gf128mul sha1_ce cpufreq_dt dwc3_am62 phy_gmii_sel sa2ul [ 37.882830] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc3+ #28 VOLUNTARY [ 37.890851] Hardware name: Bosch STLA-GSRV2-B0 (DT) [ 37.895737] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 37.902703] pc : __list_del_entry_valid_or_report+0xdc/0x114 [ 37.908390] lr : __list_del_entry_valid_or_report+0xdc/0x114 [ 37.914059] sp : ffff800080003db0 [ 37.917375] x29: ffff800080003db0 x28: 0000000000000007 x27: ffff800080e50000 [ 37.924521] x26: 0000000000000000 x25: ffff0000016abb50 x24: dead000000000122 [ 37.931666] x23: ffff0000016abb78 x22: ffff0000016ab080 x21: ffff800080003de0 [ 37.938810] x20: ffff00000255bc00 x19: ffff00000255b800 x18: 000000000000000a [ 37.945956] x17: 20747562202c3832 x16: 6362353532303030 x15: 0720072007200720 [ 37.953101] x14: 0720072007200720 x13: 0720072007200720 x12: 00000000ffffffea [ 37.960248] x11: ffff800080003b18 x10: 00000000ffffefff x9 : ffff800080f5b568 [ 37.967396] x8 : ffff800080f5b5c0 x7 : 0000000000017fe8 x6 : c0000000ffffefff [ 37.974542] x5 : ffff00000fea6688 x4 : 0000000000000000 x3 : 0000000000000000 [ 37.981686] x2 : 0000000000000000 x1 : ffff800080ef2b40 x0 : 000000000000006d [ 37.988832] Call trace: [ 37.991281] __list_del_entry_valid_or_report+0xdc/0x114 (P) [ 37.996959] ti_csi2rx_dma_callback+0x84/0x1c4 [ 38.001419] udma_vchan_complete+0x1e0/0x344 [ 38.005705] tasklet_action_common+0x118/0x310 [ 38.010163] tasklet_action+0x30/0x3c [ 38.013832] handle_softirqs+0x10c/0x2e0 [ 38.017761] __do_softirq+0x14/0x20 [ 38.021256] ____do_softirq+0x10/0x20 [ 38.024931] call_on_irq_stack+0x24/0x60 [ 38.028873] do_softirq_own_stack+0x1c/0x40 [ 38.033064] __irq_exit_rcu+0x130/0x15c [ 38.036909] irq_exit_rcu+0x10/0x20 [ 38.040403] el1_interrupt+0x38/0x60 [ 38.043987] el1h_64_irq_handler+0x18/0x24 [ 38.048091] el1h_64_irq+0x6c/0x70 [ 38.051501] default_idle_call+0x34/0xe0 (P) [ 38.055783] do_idle+0x1f8/0x250 [ 38.059021] cpu_startup_entry+0x34/0x3c [ 38.062951] rest_init+0xb4/0xc0 [ 38.066186] console_on_rootfs+0x0/0x6c [ 38.070031] __primary_switched+0x88/0x90 [ 38.074059] Code: b00037e0 91378000 f9400462 97e9bf49 (d4210000) [ 38.080168] ---[ end trace 0000000000000000 ]--- [ 38.084795] Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt [ 38.092197] SMP: stopping secondary CPUs [ 38.096139] Kernel Offset: disabled [ 38.099631] CPU features: 0x0000,00002000,02000801,0400420b [ 38.105202] Memory Limit: none [ 38.108260] ---[ end Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt ]---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b4a3d877dc92963a4db16ddb71df3d333c0d40bd\",\"lessThan\":\"68e5579f4de12207b23c41b44a4c0778b6c2858f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b4a3d877dc92963a4db16ddb71df3d333c0d40bd\",\"lessThan\":\"92d0188f36ca8082af7989d743eb5b44c2d259f7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b4a3d877dc92963a4db16ddb71df3d333c0d40bd\",\"lessThan\":\"a4a8cb0889927d59ebd839458c8f038bc5298ef9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b4a3d877dc92963a4db16ddb71df3d333c0d40bd\",\"lessThan\":\"ae42c6fe531425ef2f47e82f96851427d24bbf6b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.42\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.10\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.1\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.42\",\"matchCriteriaId\":\"EA7AA5E6-4376-4A85-A021-6ACC5FF801C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.10\",\"matchCriteriaId\":\"5890C690-B295-40C2-9121-FF5F987E5142\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.16.1\",\"matchCriteriaId\":\"58182352-D7DF-4CC9-841E-03C1D852C3FB\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/68e5579f4de12207b23c41b44a4c0778b6c2858f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/92d0188f36ca8082af7989d743eb5b44c2d259f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a4a8cb0889927d59ebd839458c8f038bc5298ef9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae42c6fe531425ef2f47e82f96851427d24bbf6b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:22:17+00:00",
      "cve": "CVE-2025-38619",
      "id": "CVE-2025-38619",
      "initial_release_date": "2025-08-22T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: ti: j721e-csi2rx: fix list_del corruption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38619.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.