CVE-2025-38237 media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
Missing hardware synchronization in the Exynos4 camera driver can cause system hangs or data corruption, requiring a kernel patch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38237?
CVE-2025-38237 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 8 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
In fimc_is_hw_change_mode(), the function changes camera modes without waiting for hardware completion, risking corrupted data or system hangs if subsequent operations proceed before the hardware is ready.
Add fimc_is_hw_wait_intmsr0_intmsd0() after mode configuration, ensuring hardware state synchronization and stable interrupt handling.
Which versions are affected by CVE-2025-38237?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38237?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-38237 being exploited?
There is no known exploitation of CVE-2025-38237 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2025-38237, DEBIAN-CVE-2025-38237, GHSA-whqr-rjq2-qj47, ROOT-OS-DEBIAN-11-CVE-2025-38237, ROOT-OS-DEBIAN-12-CVE-2025-38237, ROOT-OS-DEBIAN-13-CVE-2025-38237 and 3 more.