CVE-2025-54601
Double Free Race Condition in Samsung Exynos Wi-Fi Driver
Publication date: 2026-04-06
Last updated on: 2026-04-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| samsung | exynos_980_firmware | * |
| samsung | exynos_850_firmware | * |
| samsung | exynos_1080_firmware | * |
| samsung | exynos_1280_firmware | * |
| samsung | exynos_1330_firmware | * |
| samsung | exynos_1380_firmware | * |
| samsung | exynos_1480_firmware | * |
| samsung | exynos_1580_firmware | * |
| samsung | exynos_w930_firmware | * |
| samsung | exynos_w920_firmware | * |
| samsung | exynos_w1000_firmware | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Wi-Fi driver of certain Samsung Mobile and Wearable Processors, including models like Exynos 980, 850, 1080, and others. It is caused by improper synchronization of a global variable, which leads to a double free condition. An attacker can exploit this by triggering a race condition through concurrent invocation of an ioctl function from multiple threads.
How can this vulnerability impact me? :
The vulnerability can potentially allow an attacker to cause a double free error in the Wi-Fi driver by exploiting a race condition. This could lead to unpredictable behavior such as crashes, memory corruption, or possibly execution of arbitrary code, depending on how the double free is leveraged.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should apply the patches issued by Samsung for the affected Exynos WiFi drivers as soon as possible.
Since the vulnerability arises from improper synchronization in the WiFi driver leading to a double free, updating to the patched driver versions will prevent exploitation.