# CVE-2025-54601: Samsung Exynos Wi-Fi driver double free via race condition

Source: https://junglewise.ai/threats/cve-2025-54601-samsung-exynos-wi-fi-driver-double-free-via-race-condition  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2025-54601 · Severity: high · CVSS 7 · Published 2026-04-06

A security vulnerability has been identified in the Wi-Fi driver of several Samsung Exynos processors used in mobile phones and wearable devices like smartwatches. An attacker with local access to the device could exploit a flaw in how the system handles internal memory, potentially leading to a complete system crash or unauthorized access to sensitive data. This issue affects a wide range of Exynos chips, including the 980, 1080, and wearable-specific W-series processors.

## Quick answers

**Is CVE-2025-54601 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-54601 being exploited in the wild.

**How severe is CVE-2025-54601?** High severity, with a CVSS score of 7, published 6 April 2026.

**Which products and versions are affected?** Samsung Exynos 980; Samsung Exynos 850; Samsung Exynos 1080; Samsung Exynos 1280; and 7 more.

**Is there a fix for CVE-2025-54601?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-54601 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2025-54601?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A race condition exists in the Wi-Fi driver of multiple Samsung Exynos mobile and wearable processors due to improper synchronization of a global variable. By concurrently invoking specific ioctl functions from multiple threads, a local attacker with low privileges can trigger a double-free vulnerability. This flaw (CWE-362) can result in memory corruption, leading to a denial of service (system crash) or potentially local privilege escalation. The vulnerability affects Exynos models 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, and wearable chips W920, W930, and W1000.

## Affected products

- Samsung Exynos 980
- Samsung Exynos 850
- Samsung Exynos 1080
- Samsung Exynos 1280
- Samsung Exynos 1330
- Samsung Exynos 1380
- Samsung Exynos 1480
- Samsung Exynos 1580
- Samsung Exynos W920
- Samsung Exynos W930
- Samsung Exynos W1000

## Timeline

- 2025-05-20: disclosed: Reported date according to vendor advisory
- 2026-04-06: advisory: Initial NVD publication

## References

- [https://semiconductor.samsung.com/support/quality-support/product-security-updates/](https://semiconductor.samsung.com/support/quality-support/product-security-updates/)
- [https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54601/](https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54601/)