Executive brief
A vulnerability in the Linux kernel's camera interface driver for Texas Instruments hardware could allow a local user to crash the system. The issue occurs when the system fails to properly manage memory buffers during video data transfers, leading to internal data corruption. This results in a kernel panic, which completely halts operations and impacts the availability of the affected device.
Technical details
A vulnerability exists in the ti-j721e-csi2rx driver within the Linux kernel's media subsystem. When ti_csi2rx_start_dma() fails inside the ti_csi2rx_dma_callback() function, the affected buffer is marked with VB2_BUF_STATE_ERROR but is not removed from the DMA queue. This leads to a double list_del() operation in subsequent iterations, causing list corruption and a kernel BUG/panic. The issue is resolved by ensuring the buffer is removed from the queue before calling vb2_buffer_done() on error paths. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux Kernel b4a3d877dc92 to 68e5579f4de1, b4a3d877dc92 to 92d0188f36ca, b4a3d877dc92 to a4a8cb088992, b4a3d877dc92 to ae42c6fe5314
Timeline
- 2025-08-15: patched: Patches committed to stable kernel trees.
- 2025-08-22: advisory: NVD advisory published.