CVE-2024-32936

What it actually does

Race condition in the j721e-csi2rx DMA restart path where a submitted list is not updated before the DMA callback fires, allowing use-after-free or invalid state access that triggers kernel crashes.

Why it matters to the business

Unexpected kernel crashes on affected Linux systems can cause denial of service, interrupt media or camera workloads, and require reboots, increasing operational overhead especially in embedded or automotive deployments using the TI CSI2RX driver.

How an attack unfolds

An attacker with local access or the ability to trigger DMA submissions for the CSI2RX device can race the list update against the callback, causing the kernel to dereference stale state and crash; the low EPSS and absence from KEV indicate limited in-the-wild exploitation despite the crash potential.

How to fix it

Update the Linux kernel to a version containing commit 80a8b92950f8ee96582dba6187e3c2deca3569ea or later; rebuild and deploy the fixed kernel image on affected systems.

How to confirm the fix worked

Verify the running kernel git commit or source tree contains 80a8b92950f8ee96582dba6187e3c2deca3569ea; test DMA restart paths under load to confirm absence of crashes.

Typical attack path

1. Obtain local code execution or hardware access on a system using the j721e-csi2rx driver
2. Submit frames to the DMA engine while manipulating timing of list updates
3. Trigger the DMA callback before the submitted list is updated under lock
4. Cause invalid memory access leading to kernel panic or oops

How to detect it

Inspect kernel logs for oops or panic traces referencing j721e-csi2rx or DMA callback paths around frame submission; correlate with processes performing media or camera operations.

• j721e-csi2rx
• csi2rx_dma_callback
• submitted list not updated

What your security team should do

• Prioritize patching production kernels that include the ti j721e-csi2rx driver
• Monitor vendor or distribution kernel updates that backport the referenced commit
• Restrict unprivileged local access on systems exposing the affected hardware until patched