CVE-2025-38237

What it actually does

Race condition in fimc_is_hw_change_mode allows camera mode changes to proceed without hardware synchronization via fimc_is_hw_wait_intmsr0_intmsd0, enabling corrupted data or system hangs on subsequent operations.

Why it matters to the business

Embedded Linux systems using Exynos camera hardware face risk of instability, crashes, or data loss during camera operations, increasing downtime on affected devices with high ecosystem prevalence in LTS kernels.

How an attack unfolds

A local attacker invokes the vulnerable mode-change path in the exynos4-is driver; without the hardware wait, the race allows operations to continue before the device is ready, resulting in hangs or corruption.

How to fix it

Upgrade linux-lts (Alpaquita:stream) to 6.6.58-r0 or 6.12.41-r0 and org/pub/scm/linux/kernel/git/stable/linux.git to commit b0d92b94278561f43057003a73a17ce13b7c1a1a; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm kernel version matches a fixed release, inspect source for the added fimc_is_hw_wait_intmsr0_intmsd0 call after mode configuration, and test camera mode transitions for stability.

Typical attack path

1. Gain local user access on an affected Linux system
2. Load or interact with the exynos4-is media driver to trigger fimc_is_hw_change_mode
3. Perform subsequent operations before hardware completion to induce the race
4. Observe or exploit resulting data corruption or system hang

How to detect it

Review kernel logs for exynos4-is or fimc_is errors around mode changes, look for unexpected hangs or interrupt handling failures in camera subsystems.

What your security team should do

• Apply the listed fixed kernel versions as highest priority
• Restrict local access to camera-related drivers where possible
• Monitor EPSS trend and re-evaluate if exploit maturity increases