CVE-2025-38485

What it actually does

Race condition in Linux kernel IIO fxls8962af driver allows fxls8962af_fifo_flush to dereference indio_dev->active_scan_mask after buffer mode has been disabled, resulting in use-after-free and NULL pointer dereference during interrupt handling.

Why it matters to the business

Kernel crashes on systems using the fxls8962af accelerometer can cause unexpected reboots or denial of service; high downstream Linux kernel prevalence increases exposure across embedded and general-purpose distributions despite low EPSS and no KEV listing.

How an attack unfolds

An attacker with local access triggers rapid enable/disable of buffer mode on the fxls8962af device while interrupts are pending; the interrupt handler runs after the mask is freed, dereferencing invalid memory and potentially allowing further kernel memory corruption or privilege escalation, as seen in related Linux kernel campaigns by Advanced Spyware Campaign actors.

How to fix it

Update to a kernel containing the synchronize_irq() fix for fxls8962af_fifo_flush; for Debian 12 chromium packages apply 138.0.7204.168-1~deb12u1 or later. Rebuild and reboot after patching the kernel module.

How to confirm the fix worked

Confirm the fxls8962af driver source contains the synchronize_irq() call before disabling buffer mode; test by exercising buffer mode transitions under interrupt load and verify absence of NULL dereference in fxls8962af_fifo_flush.

Typical attack path

1. Obtain local code execution on target system
2. Load or trigger fxls8962af sensor driver buffer mode
3. Rapidly toggle buffer mode while generating FIFO interrupts
4. Cause interrupt handler to execute after active_scan_mask is freed
5. Trigger NULL pointer dereference for crash or memory corruption

How to detect it

Inspect kernel logs for NULL pointer dereference traces mentioning fxls8962af_fifo_flush, _find_first_bit_le, and irq_thread; correlate with process activity involving iio or sensor device access around crash times.

• fxls8962af_fifo_flush+0x17c/0x290
• _find_first_bit_le from fxls8962af_fifo_flush
• Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read

What your security team should do

• Prioritize kernel updates on all systems exposing IIO sensors
• Monitor for related Linux kernel privilege-escalation activity listed under threat actors
• Apply the exact Debian chromium fixed package versions where applicable
• Restrict unprivileged access to sensor device nodes until patched