CVE-2025-68175
BaseFortify
Publication date: 2025-12-16
Last updated on: 2026-04-02
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nxp | imx8-isi | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's nxp imx8-isi media driver occurs because the function mxc_isi_video_cleanup_streaming() is unconditionally called during mxc_isi_video_release(). This means that any release call, such as querying device capabilities with v4l2-ctl, can inadvertently release a currently streaming video queue, causing errors and instability. The issue happens when streaming from an ISI capture device and then querying the device, which triggers an error state and kernel warnings. The fix involves moving streaming preparation and cleanup to the vb2 framework's prepare_streaming() and unprepare_streaming() operations, preventing unintended stream releases.
How can this vulnerability impact me? :
This vulnerability can cause unintended termination of active video streams when performing certain operations like querying device capabilities. This can lead to application errors, instability, or crashes in systems relying on continuous video streaming from the affected device. It may disrupt media capture or processing workflows, potentially causing data loss or degraded functionality in applications using the nxp imx8-isi driver.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by streaming from an ISI capture device on an i.MX8MP board using gstreamer and then querying the device capabilities with v4l2-ctl. Specifically, you can run the following commands: 1. Start streaming: gst-launch-1.0 -v v4l2src device=/dev/videoX ! video/x-raw,format=GRAY8,width=1280,height=800,framerate=1/120 ! fakesink 2. While the stream is running, query the device capabilities: v4l2-ctl -l -d /dev/videoX If the vulnerability is present, this will provoke an error state and kernel warning traces similar to those described in the CVE details.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is addressed by moving the streaming preparation and cleanup to the vb2 .prepare_streaming() and .unprepare_streaming() operations in the driver. This allows the use of vb2_ioctl_streamon() and vb2_ioctl_streamoff() helpers and removes manual cleanup from mxc_isi_video_release(). Therefore, the immediate mitigation step is to update the Linux kernel to a version where this fix is applied, ensuring the driver uses the corrected streaming cleanup approach.