CVE-2025-68175: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68175 is a vulnerability in the Linux kernel's NXP i.MX8 ISI (Image Sensing Interface) media driver that can cause improper cleanup of a streaming video queue upon device release. The flaw exists in mxc_isi_video_release(), which unconditionally calls mxc_isi_video_cleanup_streaming() even when a stream is actively running, potentially disrupting an in-progress capture session. It was published on December 16, 2025, and affects the Linux kernel on i.MX8MP-based platforms. Feedly estimates the severity as Medium, with an EPSS score of 0.000180 (Feedly).

The root cause is improper state management (related to CWE-362, race condition / improper synchronization) in the mxc_isi_video_release() function within drivers/media/platform/nxp/imx8-isi/. The function unconditionally invokes mxc_isi_video_cleanup_streaming() on every file descriptor release, including benign operations like querying device capabilities via v4l2-ctl -l. This can interrupt an active Video4Linux2 (V4L2) streaming queue managed by the videobuf2 (vb2) subsystem, triggering a kernel WARNING in mxc_isi_pipe_irq_handler at imx8-isi-pipe.c:713. The fix involves gating the cleanup call on the actual streaming state using the vb2 lifecycle APIs (Feedly, WindowsForum).

Exploitation of this vulnerability can cause an active video stream on an i.MX8MP ISI capture device to be unexpectedly terminated, resulting in a denial of service for applications relying on continuous video capture (e.g., camera pipelines using GStreamer). The kernel emits a WARNING trace and the streaming queue enters an error state, requiring the application to restart the stream. The impact is limited to availability of the media subsystem on affected embedded Linux platforms; there is no evidence of confidentiality or integrity compromise (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-68175. The EPSS score is very low at 0.000180, indicating a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Triggering the bug requires local access to an i.MX8MP device with an active ISI video stream and the ability to open the same V4L2 device node concurrently (Feedly).

1. Precondition: Obtain local access to an i.MX8MP-based Linux system with the imx8_isi kernel module loaded and a V4L2 capture device (e.g., /dev/videoX) available.
2. Start a video stream: Launch a GStreamer pipeline or similar application to begin streaming from the ISI capture device: gst-launch-1.0 -v v4l2src device=/dev/videoX ! video/x-raw,format=GRAY8,width=1280,height=800,framerate=1/120 ! fakesink
3. Trigger the release path: While the stream is active, open and immediately close the same device node using a V4L2 utility: v4l2-ctl -l -d /dev/videoX
4. Observe impact: The mxc_isi_video_release() function calls mxc_isi_video_cleanup_streaming() unconditionally, tearing down the active vb2 queue and triggering a kernel WARNING in mxc_isi_pipe_irq_handler, causing the streaming application to enter an error state (Feedly, WindowsForum).

• Logs: Kernel WARNING messages in dmesg or system logs referencing mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi] at imx8-isi-pipe.c:713.
• Logs: Kernel trace lines showing CPU: 0 PID: <pid> Comm: <process> associated with unexpected release of a V4L2 streaming queue on an i.MX8MP device.
• Process: Unexpected termination or error state of video capture applications (e.g., GStreamer pipelines) coinciding with concurrent access to the same /dev/videoX device node by another process.

The Linux kernel upstream fix addresses this by conditioning the mxc_isi_video_cleanup_streaming() call on the actual vb2 streaming state, preventing cleanup when no stream is active. Patches have been committed to the stable kernel tree (commits 029914306b93, 47773031a148, a2008925ed73). Users should update to a patched kernel version that includes these fixes. Debian has issued an advisory (DSA-6238-1) incorporating this fix. As a workaround, avoid opening the ISI V4L2 device node with other tools while a stream is active (Feedly, Linux Security).

Coverage of CVE-2025-68175 has been limited to technical forums and security scanner databases. A WindowsForum thread discussed the fix in the context of vb2 lifecycle management. Tenable's Nessus (plugin 278913) and Qualys have added detection for this vulnerability. No significant vendor statements or notable researcher commentary beyond the kernel commit and scanner coverage have been observed (WindowsForum, Tenable).