{ "cveId": "CVE-2025-40165", "url": "https://patchblox.com/security/cve/CVE-2025-40165", "summary": "CVE-2025-40165 is fixed in 13 products on 1 platform, first by DEBIAN-CVE-2025-40165, released November 12, 2025. It is not reported as exploited. Patch Radar priority: Urgent.", "title": "media: nxp: imx8-isi: m2m: Fix streaming cleanup on release", "description": "In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: m2m: Fix streaming cleanup on release If streamon/streamoff calls are imbalanced, such as when exiting an application with Ctrl\u002BC when streaming, the m2m usage_count will never reach zero and the ISI channel won\u0027t be freed. Besides from that, if the input line width is more than 2K, it will trigger a WARN_ON(): [ 59.222120] ------------[ cut here ]------------ [ 59.226758] WARNING: drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c:631 at mxc_isi_channel_chain\u002B0xa4/0x120, CPU#4: v4l2-ctl/654 [ 59.238569] Modules linked in: ap1302 [ 59.242231] CPU: 4 UID: 0 PID: 654 Comm: v4l2-ctl Not tainted 6.16.0-rc4-next-20250704-06511-gff0e002d480a-dirty #258 PREEMPT [ 59.253597] Hardware name: NXP i.MX95 15X15 board (DT) [ 59.258720] pstate: 80400009 (Nzcv daif \u002BPAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 59.265669] pc : mxc_isi_channel_chain\u002B0xa4/0x120 [ 59.270358] lr : mxc_isi_channel_chain\u002B0x44/0x120 [ 59.275047] sp : ffff8000848c3b40 [ 59.278348] x29: ffff8000848c3b40 x28: ffff0000859b4c98 x27: ffff800081939f00 [ 59.285472] x26: 000000000000000a x25: ffff0000859b4cb8 x24: 0000000000000001 [ 59.292597] x23: ffff0000816f4760 x22: ffff0000816f4258 x21: ffff000084ceb780 [ 59.299720] x20: ffff000084342ff8 x19: ffff000084340000 x18: 0000000000000000 [ 59.306845] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffdb369e1c [ 59.313969] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 59.321093] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 [ 59.328217] x8 : ffff8000848c3d48 x7 : ffff800081930b30 x6 : ffff800081930b30 [ 59.335340] x5 : ffff0000859b6000 x4 : ffff80008193ae80 x3 : ffff800081022420 [ 59.342464] x2 : ffff0000852f6900 x1 : 0000000000000001 x0 : ffff000084341000 [ 59.349590] Call trace: [ 59.352025] mxc_isi_channel_chain\u002B0xa4/0x120 (P) [ 59.356722] mxc_isi_m2m_streamon\u002B0x160/0x20c [ 59.361072] v4l_streamon\u002B0x24/0x30 [ 59.364556] __video_do_ioctl\u002B0x40c/0x4a0 [ 59.368560] video_usercopy\u002B0x2bc/0x690 [ 59.372382] video_ioctl2\u002B0x18/0x24 [ 59.375857] v4l2_ioctl\u002B0x40/0x60 [ 59.379168] __arm64_sys_ioctl\u002B0xac/0x104 [ 59.383172] invoke_syscall\u002B0x48/0x104 [ 59.386916] el0_svc_common.constprop.0\u002B0xc0/0xe0 [ 59.391613] do_el0_svc\u002B0x1c/0x28 [ 59.394915] el0_svc\u002B0x34/0xf4 [ 59.397966] el0t_64_sync_handler\u002B0xa0/0xe4 [ 59.402143] el0t_64_sync\u002B0x198/0x19c [ 59.405801] ---[ end trace 0000000000000000 ]--- Address this issue by moving the streaming preparation and cleanup to the vb2 .prepare_streaming() and .unprepare_streaming() operations. This also simplifies the driver by allowing direct usage of the v4l2_m2m_ioctl_streamon() and v4l2_m2m_ioctl_streamoff() helpers.", "published": "2025-11-12T11:15:46Z", "severity": "Critical", "cvss": 9.8, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "epss": 0.00153, "epssPercentile": 0.04436, "priority": "Urgent", "priorityTier": 2, "exploited": false, "vendorExploited": false, "disclosed": false, "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40165", "fixes": [ { "platform": "linux", "product": "dtb-aarch64", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "OPENSUSE-SU-2025:20172-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20172-1", "released": "2025-12-19T17:38:16Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "OPENSUSE-SU-2025:20172-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20172-1", "released": "2025-12-19T17:38:16Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "SUSE-SU-2026:20015-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20015-1", "released": "2025-12-19T16:46:47Z" }, { "platform": "linux", "product": "kernel-default", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "OPENSUSE-SU-2025:20172-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20172-1", "released": "2025-12-19T17:38:16Z" }, { "platform": "linux", "product": "kernel-default", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "SUSE-SU-2026:20015-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20015-1", "released": "2025-12-19T16:46:47Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.8.1.160000.2.5", "fix": "OPENSUSE-SU-2025:20172-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20172-1", "released": "2025-12-19T17:38:16Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.8.1.160000.2.5", "fix": "SUSE-SU-2026:20015-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20015-1", "released": "2025-12-19T16:46:47Z" }, { "platform": "linux", "product": "kernel-docs", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "OPENSUSE-SU-2025:20172-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20172-1", "released": "2025-12-19T17:38:16Z" }, { "platform": "linux", "product": "kernel-docs", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "SUSE-SU-2026:20015-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20015-1", "released": "2025-12-19T16:46:47Z" }, { "platform": "linux", "product": "kernel-kvmsmall", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "OPENSUSE-SU-2025:20172-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20172-1", "released": "2025-12-19T17:38:16Z" }, { "platform": "linux", "product": "kernel-kvmsmall", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "SUSE-SU-2026:20015-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20015-1", "released": "2025-12-19T16:46:47Z" }, { "platform": "linux", "product": "kernel-obs-build", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "OPENSUSE-SU-2025:20172-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20172-1", "released": "2025-12-19T17:38:16Z" }, { "platform": "linux", "product": "kernel-obs-qa", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "OPENSUSE-SU-2025:20172-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20172-1", "released": "2025-12-19T17:38:16Z" }, { "platform": "linux", "product": "kernel-obs-qa", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "SUSE-SU-2026:20015-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20015-1", "released": "2025-12-19T16:46:47Z" }, { "platform": "linux", "product": "kernel-rt", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "OPENSUSE-SU-2025:20172-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20172-1", "released": "2025-12-19T17:38:16Z" }, { "platform": "linux", "product": "kernel-source", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "OPENSUSE-SU-2025:20172-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20172-1", "released": "2025-12-19T17:38:16Z" }, { "platform": "linux", "product": "kernel-source", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "SUSE-SU-2026:20015-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20015-1", "released": "2025-12-19T16:46:47Z" }, { "platform": "linux", "product": "kernel-syms", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "OPENSUSE-SU-2025:20172-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20172-1", "released": "2025-12-19T17:38:16Z" }, { "platform": "linux", "product": "kernel-syms", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "SUSE-SU-2026:20015-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20015-1", "released": "2025-12-19T16:46:47Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "OPENSUSE-SU-2025:20172-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2025-20172-1", "released": "2025-12-19T17:38:16Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.8.1", "fix": "SUSE-SU-2026:20015-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20015-1", "released": "2025-12-19T16:46:47Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.12.57-1", "fix": "DEBIAN-CVE-2025-40165", "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-40165", "released": "2025-11-12T11:15:46Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "6.17.6-1", "fix": "DEBIAN-CVE-2025-40165", "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-40165", "released": "2025-11-12T11:15:46Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T06:59:42Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }