In the Linux kernel, the following vulnerability has been resolved:
media: ti: j721e-csi2rx: fix list_del corruption
If ti_csi2rx_start_dma() fails in ti_csi2rx_dma_callback(), the buffer is marked done with VB2_BUF_STATE_ERROR but is not removed from the DMA queue. This causes the same buffer to be retried in the next iteration, resulting in a double list_del() and eventual list corruption.
Fix this by removing the buffer from the queue before calling vb2_buffer_done() on error.
This resolves a crash due to list_del corruption: [ 37.811243] j721e-csi2rx 30102000.ticsi2rx: Failed to queue the next buffer for DMA [ 37.832187] slab kmalloc-2k start ffff00000255b000 pointer offset 1064 size 2048 [ 37.839761] list_del corruption. next->prev should be ffff00000255bc28, but was ffff00000255d428. (next=ffff00000255b428) [ 37.850799] ------------[ cut here ]------------ [ 37.855424] kernel BUG at lib/list_debug.c:65! [ 37.859876] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 37.866061] Modules linked in: i2c_dev usb_f_rndis u_ether libcomposite dwc3 udc_core usb_common aes_ce_blk aes_ce_cipher ghash_ce gf128mul sha1_ce cpufreq_dt dwc3_am62 phy_gmii_sel sa2ul [ 37.882830] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc3+ #28 VOLUNTARY [ 37.890851] Hardware name: Bosch STLA-GSRV2-B0 (DT) [ 37.895737] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 37.902703] pc : __list_del_entry_valid_or_report+0xdc/0x114 [ 37.908390] lr : __list_del_entry_valid_or_report+0xdc/0x114 [ 37.914059] sp : ffff800080003db0 [ 37.917375] x29: ffff800080003db0 x28: 0000000000000007 x27: ffff800080e50000 [ 37.924521] x26: 0000000000000000 x25: ffff0000016abb50 x24: dead000000000122 [ 37.931666] x23: ffff0000016abb78 x22: ffff0000016ab080 x21: ffff800080003de0 [ 37.938810] x20: ffff00000255bc00 x19: ffff00000255b800 x18: 000000000000000a [ 37.945956] x17: 20747562202c3832 x16: 6362353532303030 x15: 0720072007200720 [ 37.953101] x14: 0720072007200720 x13: 0720072007200720 x12: 00000000ffffffea [ 37.960248] x11: ffff800080003b18 x10: 00000000ffffefff x9 : ffff800080f5b568 [ 37.967396] x8 : ffff800080f5b5c0 x7 : 0000000000017fe8 x6 : c0000000ffffefff [ 37.974542] x5 : ffff00000fea6688 x4 : 0000000000000000 x3 : 0000000000000000 [ 37.981686] x2 : 0000000000000000 x1 : ffff800080ef2b40 x0 : 000000000000006d [ 37.988832] Call trace: [ 37.991281] __list_del_entry_valid_or_report+0xdc/0x114 (P) [ 37.996959] ti_csi2rx_dma_callback+0x84/0x1c4 [ 38.001419] udma_vchan_complete+0x1e0/0x344 [ 38.005705] tasklet_action_common+0x118/0x310 [ 38.010163] tasklet_action+0x30/0x3c [ 38.013832] handle_softirqs+0x10c/0x2e0 [ 38.017761] __do_softirq+0x14/0x20 [ 38.021256] ____do_softirq+0x10/0x20 [ 38.024931] call_on_irq_stack+0x24/0x60 [ 38.028873] do_softirq_own_stack+0x1c/0x40 [ 38.033064] __irq_exit_rcu+0x130/0x15c [ 38.036909] irq_exit_rcu+0x10/0x20 [ 38.040403] el1_interrupt+0x38/0x60 [ 38.043987] el1h_64_irq_handler+0x18/0x24 [ 38.048091] el1h_64_irq+0x6c/0x70 [ 38.051501] default_idle_call+0x34/0xe0 (P) [ 38.055783] do_idle+0x1f8/0x250 [ 38.059021] cpu_startup_entry+0x34/0x3c [ 38.062951] rest_init+0xb4/0xc0 [ 38.066186] console_on_rootfs+0x0/0x6c [ 38.070031] __primary_switched+0x88/0x90 [ 38.074059] Code: b00037e0 91378000 f9400462 97e9bf49 (d4210000) [ 38.080168] ---[ end trace 0000000000000000 ]--- [ 38.084795] Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt [ 38.092197] SMP: stopping secondary CPUs [ 38.096139] Kernel Offset: disabled [ 38.099631] CPU features: 0x0000,00002000,02000801,0400420b [ 38.105202] Memory Limit: none [ 38.108260] ---[ end Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt ]---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Suse | — | Upgrade cluster-md-kmp-64kbUpgrade kernel-default-optionalUpgrade kernel-64kb-develUpgrade dtb-armUpgrade dtb-xilinxUpgrade dtb-freescaleUpgrade dlm-kmp-defaultUpgrade kernel-defaultUpgrade kselftests-kmp-rtUpgrade dtb-socionextUpgrade kernel-rt-develUpgrade dtb-nvidiaUpgrade dtb-renesasUpgrade dtb-mediatekUpgrade kernel-rt-livepatchUpgrade dtb-sprdUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-symsUpgrade dtb-caviumUpgrade kernel-64kb-extraUpgrade dlm-kmp-rtUpgrade cluster-md-kmp-rtUpgrade dtb-allwinnerUpgrade dtb-hisiliconUpgrade dtb-amdUpgrade dtb-appleUpgrade dtb-alteraUpgrade kernel-64kb-optionalUpgrade kernel-default-vdsoUpgrade kernel-develUpgrade kernel-docsUpgrade ocfs2-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-macrosUpgrade dtb-amazonUpgrade ocfs2-kmp-64kbUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-docs-htmlUpgrade gfs2-kmp-rtUpgrade dtb-lgUpgrade ocfs2-kmp-rtUpgrade kernel-rt-optionalUpgrade dtb-apmUpgrade kernel-obs-qaUpgrade dtb-amlogicUpgrade kernel-kvmsmall-vdsoUpgrade dtb-broadcomUpgrade kernel-zfcpdumpUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmallUpgrade gfs2-kmp-64kbUpgrade dtb-rockchipUpgrade dtb-qcomUpgrade dtb-exynosUpgrade kernel-sourceUpgrade kernel-default-develUpgrade kselftests-kmp-defaultUpgrade kernel-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-default-livepatchUpgrade kselftests-kmp-64kbUpgrade kernel-64kbUpgrade dtb-marvell | Dec 5, 2025 | Nov 6, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-aws-6.14Upgrade linux-image-nvidia-64kUpgrade linux-image-6.14.0-1017-azureUpgrade linux-image-awsUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-oem-22.04dUpgrade linux-image-azure-6.14Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-gcp-6.8Upgrade linux-image-xilinx-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-oracleUpgrade linux-image-azure-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-gcp-6.14Upgrade linux-image-realtime-6.8.1Upgrade linux-image-aws-64k-6.14Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-oracle-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-virtual-6.14Upgrade linux-image-aws-fips-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-generic-64k-6.14Upgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-oem-24.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.14.0-36-genericUpgrade linux-image-aws-64kUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-generic-6.14Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-aws-fipsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gkeUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-realtime-6.14Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-kvmUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.14.0-1017-awsUpgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-realtimeUpgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-intel-iotgUpgrade linux-image-virtualUpgrade linux-image-xilinxUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-raspiUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-ibm-classicUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-oem-22.04bUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-generic-64k-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-oem-22.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-nvidiaUpgrade linux-image-azure-fips-6.8Upgrade linux-image-fipsUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-gkeop-6.8Upgrade linux-image-oracle-6.14Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-aws-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-ibm-6.8Upgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-genericUpgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.14.0-1016-oemUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-oem-6.14Upgrade linux-image-oem-24.04aUpgrade linux-image-gke-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-gke-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-gcpUpgrade linux-image-gcp-fipsUpgrade linux-image-fips-6.8Upgrade linux-image-azureUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-raspi-6.14Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-gkeopUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-aws-64k-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oem-22.04cUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-6.8.1-1041-realtime | Nov 25, 2025 | Nov 21, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub