# CVE-2025-54602: Samsung Exynos Wi-Fi driver use-after-free via race condition

Source: https://junglewise.ai/threats/cve-2025-54602-samsung-exynos-wi-fi-driver-use-after-free-via-race-condition  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2025-54602 · Severity: high · CVSS 7 · Published 2026-04-06

A security vulnerability has been identified in the Wi-Fi software driver used by several Samsung Exynos mobile and wearable processors. This flaw could allow a malicious application installed on a device to cause system instability or potentially gain unauthorized access to sensitive data. The issue affects a wide range of Samsung smartphones and smartwatches using these specific chips.

## Quick answers

**Is CVE-2025-54602 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-54602 being exploited in the wild.

**How severe is CVE-2025-54602?** High severity, with a CVSS score of 7, published 6 April 2026.

**Which products and versions are affected?** Samsung Exynos 980; Samsung Exynos 850; Samsung Exynos 1080; Samsung Exynos 1280; and 7 more.

**Is there a fix for CVE-2025-54602?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-54602 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2025-54602?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the Wi-Fi driver of multiple Samsung Exynos chipsets (980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000). The root cause is improper synchronization (CWE-362) when accessing a global variable, which allows an attacker to trigger a race condition. By concurrently invoking an ioctl function from multiple threads, a local attacker with low privileges can cause memory corruption. This can lead to local privilege escalation or a complete system crash (denial of service).

## Affected products

- Samsung Exynos 980
- Samsung Exynos 850
- Samsung Exynos 1080
- Samsung Exynos 1280
- Samsung Exynos 1330
- Samsung Exynos 1380
- Samsung Exynos 1480
- Samsung Exynos 1580
- Samsung Exynos W920
- Samsung Exynos W930
- Samsung Exynos W1000

## Timeline

- 2025-05-20: disclosed: Reported date according to vendor advisory
- 2026-04-06: advisory: NVD publication date

## References

- [https://semiconductor.samsung.com/support/quality-support/product-security-updates/](https://semiconductor.samsung.com/support/quality-support/product-security-updates/)
- [https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54602/](https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54602/)