CVE-2025-38619

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: ti: j721e-csi2rx: fix list_del corruption

If ti_csi2rx_start_dma() fails in ti_csi2rx_dma_callback(), the buffer is

marked done with VB2_BUF_STATE_ERROR but is not removed from the DMA queue.

This causes the same buffer to be retried in the next iteration, resulting

in a double list_del() and eventual list corruption.

Fix this by removing the buffer from the queue before calling

vb2_buffer_done() on error.

This resolves a crash due to list_del corruption:

[ 37.811243] j721e-csi2rx 30102000.ticsi2rx: Failed to queue the next buffer for DMA

[ 37.832187] slab kmalloc-2k start ffff00000255b000 pointer offset 1064 size 2048

[ 37.839761] list_del corruption. next->prev should be ffff00000255bc28, but was ffff00000255d428. (next=ffff00000255b428)

[ 37.850799] ------------[ cut here ]------------

[ 37.855424] kernel BUG at lib/list_debug.c:65!

[ 37.859876] Internal error: Oops - BUG: 00000000f2000800 [#

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References