CVE-2025-40015

Vulnerability

In the Linux kernel's STM32 Camera Serial Interface (CSI) driver, a NULL-pointer dereference vulnerability exists in the stm32_csi_start function. The code dereferences csidev->s_subdev to obtain src_pad before performing a NULL check on the same pointer later, creating a window where a NULL s_subdev can lead to a crash [1].

Exploitation

An attacker with the ability to influence the state of the video pipeline could trigger the vulnerable code path, causing the driver to dereference a NULL pointer if s_subdev is not properly set [2]. No special privileges or authentication are required beyond local access to manipulate the media device.

Impact

Successful exploitation results in a kernel NULL pointer dereference, leading to a system crash or denial of service. There is no evidence of privilege escalation or arbitrary code execution from this bug [3].

Mitigation

The fix moves the dereference after the proper NULL check, preventing the unsafe access. The patch has been applied to the stable kernel tree; users should update to a kernel version containing this commit to mitigate the issue [1].