CVE-2025-68175 (GCVE-0-2025-68175)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:42 – Updated: 2026-08-05 12:10
VLAI
Title
media: nxp: imx8-isi: Fix streaming cleanup on release
Summary
In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix streaming cleanup on release The current implementation unconditionally calls mxc_isi_video_cleanup_streaming() in mxc_isi_video_release(). This can lead to situations where any release call (like from a simple "v4l2-ctl -l") may release a currently streaming queue when called on such a device. This is reproducible on an i.MX8MP board by streaming from an ISI capture device using gstreamer: gst-launch-1.0 -v v4l2src device=/dev/videoX ! \ video/x-raw,format=GRAY8,width=1280,height=800,framerate=1/120 ! \ fakesink While this stream is running, querying the caps of the same device provokes the error state: v4l2-ctl -l -d /dev/videoX This results in the following trace: [ 155.452152] ------------[ cut here ]------------ [ 155.452163] WARNING: CPU: 0 PID: 1708 at drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c:713 mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi] [ 157.004248] Modules linked in: cfg80211 rpmsg_ctrl rpmsg_char rpmsg_tty virtio_rpmsg_bus rpmsg_ns rpmsg_core rfkill nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables mcp251x6 [ 157.053499] CPU: 0 UID: 0 PID: 1708 Comm: python3 Not tainted 6.15.4-00114-g1f61ca5cad76 #1 PREEMPT [ 157.064369] Hardware name: imx8mp_board_01 (DT) [ 157.068205] pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 157.075169] pc : mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi] [ 157.081195] lr : mxc_isi_pipe_irq_handler+0x38/0x1b0 [imx8_isi] [ 157.087126] sp : ffff800080003ee0 [ 157.090438] x29: ffff800080003ee0 x28: ffff0000c3688000 x27: 0000000000000000 [ 157.097580] x26: 0000000000000000 x25: ffff0000c1e7ac00 x24: ffff800081b5ad50 [ 157.104723] x23: 00000000000000d1 x22: 0000000000000000 x21: ffff0000c25e4000 [ 157.111866] x20: 0000000060000200 x19: ffff80007a0608d0 x18: 0000000000000000 [ 157.119008] x17: ffff80006a4e3000 x16: ffff800080000000 x15: 0000000000000000 [ 157.126146] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 157.133287] x11: 0000000000000040 x10: ffff0000c01445f0 x9 : ffff80007a053a38 [ 157.140425] x8 : ffff0000c04004b8 x7 : 0000000000000000 x6 : 0000000000000000 [ 157.147567] x5 : ffff0000c0400490 x4 : ffff80006a4e3000 x3 : ffff0000c25e4000 [ 157.154706] x2 : 0000000000000000 x1 : ffff8000825c0014 x0 : 0000000060000200 [ 157.161850] Call trace: [ 157.164296] mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi] (P) [ 157.170319] __handle_irq_event_percpu+0x58/0x218 [ 157.175029] handle_irq_event+0x54/0xb8 [ 157.178867] handle_fasteoi_irq+0xac/0x248 [ 157.182968] handle_irq_desc+0x48/0x68 [ 157.186723] generic_handle_domain_irq+0x24/0x38 [ 157.191346] gic_handle_irq+0x54/0x120 [ 157.195098] call_on_irq_stack+0x24/0x30 [ 157.199027] do_interrupt_handler+0x88/0x98 [ 157.203212] el0_interrupt+0x44/0xc0 [ 157.206792] __el0_irq_handler_common+0x18/0x28 [ 157.211328] el0t_64_irq_handler+0x10/0x20 [ 157.215429] el0t_64_irq+0x198/0x1a0 [ 157.219009] ---[ end trace 0000000000000000 ]--- Address this issue by moving the streaming preparation and cleanup to the vb2 .prepare_streaming() and .unprepare_streaming() operations. This also simplifies the driver by allowing direct usage of the vb2_ioctl_streamon() and vb2_ioctl_streamoff() helpers, and removal of the manual cleanup from mxc_isi_video_release().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cf21f328fcafacf4f96e7a30ef9dceede1076378 , < a2008925ed7361d69f92f63f0a779c300432610a (git)
Affected: cf21f328fcafacf4f96e7a30ef9dceede1076378 , < 029914306b93b37c6e7060793d2b6f76b935cfa6 (git)
Affected: cf21f328fcafacf4f96e7a30ef9dceede1076378 , < 47773031a148ad7973b809cc7723cba77eda2b42 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.12.80 , ≤ 6.12.* (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a2008925ed7361d69f92f63f0a779c300432610a",
              "status": "affected",
              "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
              "versionType": "git"
            },
            {
              "lessThan": "029914306b93b37c6e7060793d2b6f76b935cfa6",
              "status": "affected",
              "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
              "versionType": "git"
            },
            {
              "lessThan": "47773031a148ad7973b809cc7723cba77eda2b42",
              "status": "affected",
              "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: nxp: imx8-isi: Fix streaming cleanup on release\n\nThe current implementation unconditionally calls\nmxc_isi_video_cleanup_streaming() in mxc_isi_video_release(). This can\nlead to situations where any release call (like from a simple\n\"v4l2-ctl -l\") may release a currently streaming queue when called on\nsuch a device.\n\nThis is reproducible on an i.MX8MP board by streaming from an ISI\ncapture device using gstreamer:\n\n\tgst-launch-1.0 -v v4l2src device=/dev/videoX ! \\\n\t    video/x-raw,format=GRAY8,width=1280,height=800,framerate=1/120 ! \\\n\t    fakesink\n\nWhile this stream is running, querying the caps of the same device\nprovokes the error state:\n\n\tv4l2-ctl -l -d /dev/videoX\n\nThis results in the following trace:\n\n[  155.452152] ------------[ cut here ]------------\n[  155.452163] WARNING: CPU: 0 PID: 1708 at drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c:713 mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi]\n[  157.004248] Modules linked in: cfg80211 rpmsg_ctrl rpmsg_char rpmsg_tty virtio_rpmsg_bus rpmsg_ns rpmsg_core rfkill nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables mcp251x6\n[  157.053499] CPU: 0 UID: 0 PID: 1708 Comm: python3 Not tainted 6.15.4-00114-g1f61ca5cad76 #1 PREEMPT\n[  157.064369] Hardware name: imx8mp_board_01 (DT)\n[  157.068205] pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  157.075169] pc : mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi]\n[  157.081195] lr : mxc_isi_pipe_irq_handler+0x38/0x1b0 [imx8_isi]\n[  157.087126] sp : ffff800080003ee0\n[  157.090438] x29: ffff800080003ee0 x28: ffff0000c3688000 x27: 0000000000000000\n[  157.097580] x26: 0000000000000000 x25: ffff0000c1e7ac00 x24: ffff800081b5ad50\n[  157.104723] x23: 00000000000000d1 x22: 0000000000000000 x21: ffff0000c25e4000\n[  157.111866] x20: 0000000060000200 x19: ffff80007a0608d0 x18: 0000000000000000\n[  157.119008] x17: ffff80006a4e3000 x16: ffff800080000000 x15: 0000000000000000\n[  157.126146] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n[  157.133287] x11: 0000000000000040 x10: ffff0000c01445f0 x9 : ffff80007a053a38\n[  157.140425] x8 : ffff0000c04004b8 x7 : 0000000000000000 x6 : 0000000000000000\n[  157.147567] x5 : ffff0000c0400490 x4 : ffff80006a4e3000 x3 : ffff0000c25e4000\n[  157.154706] x2 : 0000000000000000 x1 : ffff8000825c0014 x0 : 0000000060000200\n[  157.161850] Call trace:\n[  157.164296]  mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi] (P)\n[  157.170319]  __handle_irq_event_percpu+0x58/0x218\n[  157.175029]  handle_irq_event+0x54/0xb8\n[  157.178867]  handle_fasteoi_irq+0xac/0x248\n[  157.182968]  handle_irq_desc+0x48/0x68\n[  157.186723]  generic_handle_domain_irq+0x24/0x38\n[  157.191346]  gic_handle_irq+0x54/0x120\n[  157.195098]  call_on_irq_stack+0x24/0x30\n[  157.199027]  do_interrupt_handler+0x88/0x98\n[  157.203212]  el0_interrupt+0x44/0xc0\n[  157.206792]  __el0_irq_handler_common+0x18/0x28\n[  157.211328]  el0t_64_irq_handler+0x10/0x20\n[  157.215429]  el0t_64_irq+0x198/0x1a0\n[  157.219009] ---[ end trace 0000000000000000 ]---\n\nAddress this issue by moving the streaming preparation and cleanup to\nthe vb2 .prepare_streaming() and .unprepare_streaming() operations. This\nalso simplifies the driver by allowing direct usage of the\nvb2_ioctl_streamon() and vb2_ioctl_streamoff() helpers, and removal of\nthe manual cleanup from mxc_isi_video_release()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through open()/close() on a V4L2 capture character device (/dev/videoN) exposed by the i.MX8 ISI driver, which requires local access to the system. No network or physical-device interaction is involved.\nAC:L - A single attacker controls both sides entirely \u2014 open fd1 and STREAMON, then open and close fd2 \u2014 and the unconditional `mxc_isi_video_cleanup_streaming()` in the release path fires deterministically with no race window to win, as demonstrated by the reporter with plain gstreamer plus `v4l2-ctl -l`.\nPR:L - Only an unprivileged local user holding an open file descriptor on the ISI video node is needed (video-group/camera-service DAC access on typical i.MX8 embedded and Android-class deployments); no capabilities, root, or ioctl privilege checks guard the release path.\nUI:N - The attacker performs both the STREAMON and the second open/close from its own processes, so no victim action is required; a concurrently streaming system camera daemon merely provides an additional trigger path.\nS:U - The corruption stays within the kernel\u0027s own security authority \u2014 freed kernel DMA memory, media-controller heap objects, and ISI hardware channel state \u2014 with no VM, IOMMU, or sandbox boundary crossed.\nC:H - `media_pipeline_cleanup()` kfrees `media_pipeline_pad` objects that remain linked into a live pipeline and are read by subsequent pipeline walks, and the coherent DMA pages freed under active hardware use are recycled into arbitrary kernel allocations, making this a use-after-free that can be leveraged into kernel memory disclosure.\nI:H - After `dma_free_coherent()` the ISI engine keeps writing attacker-influenceable image data into those freed, reallocated kernel pages on every frame via the still-programmed stale DMA addresses, yielding a sustained arbitrary kernel-memory write primitive, compounded by hardware resource/refcount corruption from the premature channel release and unchain.\nA:H - The frame-end IRQ immediately hits `WARN_ON(!pipe-\u003eirq_handler)` in `mxc_isi_pipe_irq_handler()` (fatal with panic_on_warn), the DMA-after-free corrupts arbitrary kernel memory leading to oops/panic, and the premature `mxc_isi_channel_sw_reset()` breaks concurrent camera streams \u2014 all trivially and repeatedly triggerable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:10:02.111Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a2008925ed7361d69f92f63f0a779c300432610a"
        },
        {
          "url": "https://git.kernel.org/stable/c/029914306b93b37c6e7060793d2b6f76b935cfa6"
        },
        {
          "url": "https://git.kernel.org/stable/c/47773031a148ad7973b809cc7723cba77eda2b42"
        }
      ],
      "title": "media: nxp: imx8-isi: Fix streaming cleanup on release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68175",
    "datePublished": "2025-12-16T13:42:54.913Z",
    "dateReserved": "2025-12-16T13:41:40.251Z",
    "dateUpdated": "2026-08-05T12:10:02.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68175",
      "date": "2026-09-21",
      "epss": "0.00152",
      "percentile": "0.04764"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a2008925ed7361d69f92f63f0a779c300432610a",
                    "status": "affected",
                    "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "029914306b93b37c6e7060793d2b6f76b935cfa6",
                    "status": "affected",
                    "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "47773031a148ad7973b809cc7723cba77eda2b42",
                    "status": "affected",
                    "version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.4"
                  },
                  {
                    "lessThan": "6.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.80",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: nxp: imx8-isi: Fix streaming cleanup on release\n\nThe current implementation unconditionally calls\nmxc_isi_video_cleanup_streaming() in mxc_isi_video_release(). This can\nlead to situations where any release call (like from a simple\n\"v4l2-ctl -l\") may release a currently streaming queue when called on\nsuch a device.\n\nThis is reproducible on an i.MX8MP board by streaming from an ISI\ncapture device using gstreamer:\n\n\tgst-launch-1.0 -v v4l2src device=/dev/videoX ! \\\n\t    video/x-raw,format=GRAY8,width=1280,height=800,framerate=1/120 ! \\\n\t    fakesink\n\nWhile this stream is running, querying the caps of the same device\nprovokes the error state:\n\n\tv4l2-ctl -l -d /dev/videoX\n\nThis results in the following trace:\n\n[  155.452152] ------------[ cut here ]------------\n[  155.452163] WARNING: CPU: 0 PID: 1708 at drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c:713 mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi]\n[  157.004248] Modules linked in: cfg80211 rpmsg_ctrl rpmsg_char rpmsg_tty virtio_rpmsg_bus rpmsg_ns rpmsg_core rfkill nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables mcp251x6\n[  157.053499] CPU: 0 UID: 0 PID: 1708 Comm: python3 Not tainted 6.15.4-00114-g1f61ca5cad76 #1 PREEMPT\n[  157.064369] Hardware name: imx8mp_board_01 (DT)\n[  157.068205] pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  157.075169] pc : mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi]\n[  157.081195] lr : mxc_isi_pipe_irq_handler+0x38/0x1b0 [imx8_isi]\n[  157.087126] sp : ffff800080003ee0\n[  157.090438] x29: ffff800080003ee0 x28: ffff0000c3688000 x27: 0000000000000000\n[  157.097580] x26: 0000000000000000 x25: ffff0000c1e7ac00 x24: ffff800081b5ad50\n[  157.104723] x23: 00000000000000d1 x22: 0000000000000000 x21: ffff0000c25e4000\n[  157.111866] x20: 0000000060000200 x19: ffff80007a0608d0 x18: 0000000000000000\n[  157.119008] x17: ffff80006a4e3000 x16: ffff800080000000 x15: 0000000000000000\n[  157.126146] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n[  157.133287] x11: 0000000000000040 x10: ffff0000c01445f0 x9 : ffff80007a053a38\n[  157.140425] x8 : ffff0000c04004b8 x7 : 0000000000000000 x6 : 0000000000000000\n[  157.147567] x5 : ffff0000c0400490 x4 : ffff80006a4e3000 x3 : ffff0000c25e4000\n[  157.154706] x2 : 0000000000000000 x1 : ffff8000825c0014 x0 : 0000000060000200\n[  157.161850] Call trace:\n[  157.164296]  mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi] (P)\n[  157.170319]  __handle_irq_event_percpu+0x58/0x218\n[  157.175029]  handle_irq_event+0x54/0xb8\n[  157.178867]  handle_fasteoi_irq+0xac/0x248\n[  157.182968]  handle_irq_desc+0x48/0x68\n[  157.186723]  generic_handle_domain_irq+0x24/0x38\n[  157.191346]  gic_handle_irq+0x54/0x120\n[  157.195098]  call_on_irq_stack+0x24/0x30\n[  157.199027]  do_interrupt_handler+0x88/0x98\n[  157.203212]  el0_interrupt+0x44/0xc0\n[  157.206792]  __el0_irq_handler_common+0x18/0x28\n[  157.211328]  el0t_64_irq_handler+0x10/0x20\n[  157.215429]  el0t_64_irq+0x198/0x1a0\n[  157.219009] ---[ end trace 0000000000000000 ]---\n\nAddress this issue by moving the streaming preparation and cleanup to\nthe vb2 .prepare_streaming() and .unprepare_streaming() operations. This\nalso simplifies the driver by allowing direct usage of the\nvb2_ioctl_streamon() and vb2_ioctl_streamoff() helpers, and removal of\nthe manual cleanup from mxc_isi_video_release()."
          }
        ],
        "id": "CVE-2025-68175",
        "lastModified": "2026-07-30T06:24:32.193",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-16T14:15:49.433",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/029914306b93b37c6e7060793d2b6f76b935cfa6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/47773031a148ad7973b809cc7723cba77eda2b42"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a2008925ed7361d69f92f63f0a779c300432610a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-13T17:35:15+00:00",
      "cve": "CVE-2025-68175",
      "id": "CVE-2025-68175",
      "initial_release_date": "2025-12-16T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of service in NXP i.MX8 ISI driver via improper streaming cleanup",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68175.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T16:50:38Z",
      "cve": "CVE-2025-68175",
      "id": "CVE-2025-68175",
      "initial_release_date": "2025-12-17T00:26:16Z",
      "product_status:known_affected": "169",
      "product_status:known_not_affected": "388",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68175",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68175.json",
      "version": "16"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.