The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - media: ti: j721e-csi2rx: fix list_del corruption If ti_csi2rx_start_dma() fails in     ti_csi2rx_dma_callback(), the buffer is marked done with VB2_BUF_STATE_ERROR but is not removed from the     DMA queue. This causes the same buffer to be retried in the next iteration, resulting in a double     list_del() and eventual list corruption. Fix this by removing the buffer from the queue before calling     vb2_buffer_done() on error. This resolves a crash due to list_del corruption: [ 37.811243] j721e-csi2rx     30102000.ticsi2rx: Failed to queue the next buffer for DMA [ 37.832187] slab kmalloc-2k start     ffff00000255b000 pointer offset 1064 size 2048 [ 37.839761] list_del corruption. next->prev should be     ffff00000255bc28, but was ffff00000255d428. (next=ffff00000255b428) [ 37.850799] ------------[ cut here     ]------------ [ 37.855424] kernel BUG at lib/list_debug.c:65! [ 37.859876] Internal error: Oops - BUG:
    00000000f2000800 [#1] SMP [ 37.866061] Modules linked in: i2c_dev usb_f_rndis u_ether libcomposite dwc3     udc_core usb_common aes_ce_blk aes_ce_cipher ghash_ce gf128mul sha1_ce cpufreq_dt dwc3_am62 phy_gmii_sel     sa2ul [ 37.882830] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc3+ #28 VOLUNTARY [ 37.890851]     Hardware name: Bosch STLA-GSRV2-B0 (DT) [ 37.895737] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS     BTYPE=--) [ 37.902703] pc : __list_del_entry_valid_or_report+0xdc/0x114 [ 37.908390] lr :
    __list_del_entry_valid_or_report+0xdc/0x114 [ 37.914059] sp : ffff800080003db0 [ 37.917375] x29:
    ffff800080003db0 x28: 0000000000000007 x27: ffff800080e50000 [ 37.924521] x26: 0000000000000000 x25:
    ffff0000016abb50 x24: dead000000000122 [ 37.931666] x23: ffff0000016abb78 x22: ffff0000016ab080 x21:
    ffff800080003de0 [ 37.938810] x20: ffff00000255bc00 x19: ffff00000255b800 x18: 000000000000000a [     37.945956] x17: 20747562202c3832 x16: 6362353532303030 x15: 0720072007200720 [ 37.953101] x14:
    0720072007200720 x13: 0720072007200720 x12: 00000000ffffffea [ 37.960248] x11: ffff800080003b18 x10:
    00000000ffffefff x9 : ffff800080f5b568 [ 37.967396] x8 : ffff800080f5b5c0 x7 : 0000000000017fe8 x6 :
    c0000000ffffefff [ 37.974542] x5 : ffff00000fea6688 x4 : 0000000000000000 x3 : 0000000000000000 [     37.981686] x2 : 0000000000000000 x1 : ffff800080ef2b40 x0 : 000000000000006d [ 37.988832] Call trace: [     37.991281] __list_del_entry_valid_or_report+0xdc/0x114 (P) [ 37.996959] ti_csi2rx_dma_callback+0x84/0x1c4     [ 38.001419] udma_vchan_complete+0x1e0/0x344 [ 38.005705] tasklet_action_common+0x118/0x310 [ 38.010163]     tasklet_action+0x30/0x3c [ 38.013832] handle_softirqs+0x10c/0x2e0 [ 38.017761] __do_softirq+0x14/0x20 [     38.021256] ____do_softirq+0x10/0x20 [ 38.024931] call_on_irq_stack+0x24/0x60 [ 38.028873]     do_softirq_own_stack+0x1c/0x40 [ 38.033064] __irq_exit_rcu+0x130/0x15c [ 38.036909] irq_exit_rcu+0x10/0x20     [ 38.040403] el1_interrupt+0x38/0x60 [ 38.043987] el1h_64_irq_handler+0x18/0x24 [ 38.048091]     el1h_64_irq+0x6c/0x70 [ 38.051501] default_idle_call+0x34/0xe0 (P) [ 38.055783] do_idle+0x1f8/0x250 [     38.059021] cpu_startup_entry+0x34/0x3c [ 38.062951] rest_init+0xb4/0xc0 [ 38.066186]     console_on_rootfs+0x0/0x6c [ 38.070031] __primary_switched+0x88/0x90 [ 38.074059] Code: b00037e0 91378000     f9400462 97e9bf49 (d4210000) [ 38.080168] ---[ end trace 0000000000000000 ]--- [ 38.084795] Kernel panic -     not syncing: Oops - BUG: Fatal exception in interrupt [ 38.092197] SMP: stopping secondary CPUs [     38.096139] Kernel Offset: disabled [ 38.099631] CPU features: 0x0000,00002000,02000801,0400420b [     38.105202] Memory Limit: none [ 38.108260] ---[ end Kernel panic - not syncing: Oops - BUG: Fatal     exception in interrupt ]--- (CVE-2025-38619)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - mediatij721e-csi2rxlist_del 破損を修正します ti_csi2rx_start_dma() が ti_csi2rx_dma_callback() で失敗した場合、バッファは VB2_BUF_STATE_ERROR で完了とマークされますが、DMA キューから削除されません。これにより、次の反復で同じバッファが再試行され、二重の list_del() および最終的なリストの破損を引き起こします。エラー時に vb2_buffer_done() を呼び出す前にキューからバッファを削除することでこれを修正します。これにより、list_del 破損によるクラッシュを解決します [ 37.811243] j721e-csi2rx 30102000.ticsi2rxDMA 用の次のバッファのキューに失敗しました [ 37.832187] slab kmalloc-2k start ffff00000255b000 ポインターオフセット 1064 サイズ 2048 [ 37.839761] list_del 破損。 next->prev は ffff00000255bc28 である必要がありますが、ffff00000255d428 でした。next=ffff00000255b428、 37.850799[、] 、 -------------[ここで挿入]-----------、 [ 37.855424、 ] 、lib/list_debug.c:65 でのカーネルのバグ! [ 37.859876] 内部エラーOops - BUG
    00000000f2000800 [#1] SMP [ 37.866061] Modules linked in: i2c_dev usb_f_rndis u_ether libcomposite dwc3 udc_core usb_common aes_ce_blk aes_ce_cipher ghash_ce gf128mul sha1_ce cpufreq_dt dwc3_am62 phy_gmii_sel sa2ul [ 37.882830] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc3+ #28 VOLUNTARY [ 37.890851] ハードウェア名: Bosch STLA-GSRV2-B0DT[ 37.895737] pstate: 600000c5nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--[] 37.902703] pc __list_del_entry_valid_or_report+0xdc/0x114 [ 37.908390] lr
    __list_del_entry_valid_or_report+0xdc/0x114 [ 37.914059] sp : ffff800080003db0 [ 37.917375] x29
    ffff800080003db0 x28: 000000000000007 x27: ffff800080e50000 [ 37.924521] x26: 00000000000000000000000000000000000000000000000000000000000
    ffff0000016abb50 x24dead000000000122 [ 37.931666] x23ffff0000016abb78 x22ffff0000016ab080 x21
    ffff800080003de0 [ 37.938810] x20: ffff00000255bc00 x19: ffff00000255b800 x18: 000000000000000a [37.945956] x17: 20747562202c3832 x16: 6362353532303030 x15: 0720072007200720 [ 37.953101] x14:
    0720072007200720 x13: 0720072007200720 x12: 00000000ffffffea [ 37.960248] x11: ffff800080003b18 x10:
    00000000ffffefff x9 : ffff800080f5b568 [ 37.967396] x8 : ffff800080f5b5c0 x7 : 0000000000017fe8 x6
    c0000000ffffefff [ 37.974542] x5 : ffff00000fea6688 x4 : 0000000000000000 x3 : 0000000000000000 [37.981686] x2 : 0000000000000000 x1 : ffff800080ef2b40 x0 : 000000000000006d [ 37.988832] Call trace: [37.991281] __list_del_entry_valid_or_report+0xdc/0x114 (P) [ 37.996959] ti_csi2rx_dma_callback+0x84/0x1c4 [ 38.001419] udma_vchan_complete+0x1e0/0x344 [ 38.005705 ] tasklet_action_common+0x118/0x310 38.010163[ ] tasklet_action+0x30/0x3c 38.013832[ ] handle_softirqs+0x10c/0x2e0x10 38.017761__dot400000000000000000000000 [38.021256__do_softirq+0x10/0x20 [ 38.024931] call_on_irq_stack+0x24/0x60 [ 38.028873] do_softirq_own_stack+0x1c/0x40 [ 38.033064] __irq_exit_rcu+0x130/0x15c [ 38.036909] irq_exit_rcu+0x10/0x20 [ [] ] irq_exit_rcu+0x10/0x20 38.040403_inter] +0x38/0x60 [ 38.043987] el1h_64_irq_handler+0x18/0x24 [ 38.048091] el1h_64_irq+0x6c/0x70 [ 38.051501] default_idle_call+0x34/0xe0 (P) [ 38.055783] do_idle+0x1f8/0x2500 [38.059021] cpu_startup_entry+0x34 /0x3c 38.062951] rest_init+0xb4/0xc0 [ 38.066186] console_on_rootfs+0x0/0x6c [ 38.070031] __primary_switched+0x88/0x90 [ 38.074059] コード: b0037e0 91378000 f9400462 97e9bf49 (d4210000) [] --- 38.080168---[]トレース終了000000000000000 ]--- 38.084795カーネルパニック - 同期しない Oops - BUG割り込みでの致命的な例外 [ 38.092197] SMPセカンダリ CPU の停止 [38.096139] カーネルオフセット無効化 38.099631] CPU 機能0x0000,00002000 ,02000801,0400420b [38.105202] メモリ制限なし [ 38.108260] ---[ カーネルパニックの終了 - 非同期Oops - バグ割り込みの致命的な例外 ]---CVE-2025-38619]

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - mediati j721e-csi2rx修正 list_del 損毀如果 ti_csi2rx_start_dma() 在 ti_csi2rx_dma_callback() 中失敗會使用 VB2_BUF_STATE_ERROR 將緩衝區標記為完成但不會從 DMA 佇列中移除。這會造成系統在下次反覆運算時重試相同的緩衝區進而導致雙重 list_del() 和最終清單損毀。透過在發生錯誤呼叫 vb2_buffer_done() 之前移除佇列中的緩衝區來修正此問題。這可解決因 list_del 損毀而造成的當機 [ 37.811243] j721e-csi2rx 30102000.ticsi2rx: 無法將下一個 DMA 緩衝區佇列 [ 37.832187] slab kmalloc-2k 啟動 ffff00000255b000 指標位移 1064 大小 2048 [ 37.839761] list_del 損毀。 next->prev 應為 ffff00000255bc28但為 ffff00000255d428。 (next=ffff00000255b428) [ 37.850799] ------------[截到此處]------------ [ 37.855424] lib/list_debug.c:65 的核心錯誤! [ 37.859876] 內部錯誤Oops - 錯誤
    00000000f2000800 [#1] SMP [ 37.866061] Modules linked in: i2c_dev usb_f_rndis u_ether libcomposite dwc3 udc_core usb_common aes_ce_blk aes_ce_cipher ghash_ce gf128mul sha1_ce cpufreq_dt dwc3_am62 phy_gmii_sel sa2ul [ 37.882830] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc3+ #28 VOLUNTARY [ 37.890851] 硬體名稱Bosch STLA-GSRV2-B0 (DT) [ 37.895737] pstate 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 37.902703] pc __list_del_entry_valid_or_report+0xdc/0x114 [ 37.908390] lr
    __list_del_entry_valid_or_report+0xdc/0x114 [ 37.914059] spffff800080003db0 [ 37.917375] x29
    ffff800080003db0 x280000000000000007 x27ffff800080e50000 [ 37.924521] x260000000000000000 x25
    ffff0000016abb50 x24dead000000000122 [ 37.931666] x23ffff0000016abb78 x22ffff0000016ab080 x21
    ffff800080003de0 [ 37.938810] x20: ffff00000255bc00 x19: ffff00000255b800 x18: 000000000000000a [37.945956] x17: 20747562202c3832 x16: 6362353532303030 x15: 0720072007200720 [ 37.953101] x14:
    0720072007200720 x130720072007200720 x1200000000ffffffea [ 37.960248] x11ffff800080003b18 x10
    00000000ffffefff x9 ffff800080f5b568 [ 37.967396] x8 ffff800080f5b5c0 x7 0000000000017fe8 x6
    c0000000ffffefff [ 37.974542] x5 : ffff00000fea6688 x4 : 0000000000000000 x3 : 0000000000000000 [37.981686] x2 : 0000000000000000 x1 : ffff800080ef2b40 x0 : 000000000000006d [ 37.988832] Call trace: [37.991281] __list_del_entry_valid_or_report+0xdc/0x114 (P) [ 37.996959] ti_csi2rx_dma_callback+0x84/0x1c4 [ 38.001419] udma_vchan_complete+0x1e0/0x344 [ 38.005705] tasklet_action_common+0x118/0x310 [ 38.010163] tasklet_action+0x30/0x3c [ 38.013832] handle_softirqs+0x10c/0x2e0 [ 38.017761] ] __do_x0softirq+014/0_x2_x0softirq+014/0x310 [38.021256]____do_softirq+0x10/0x20 [ 38.024931] call_on_irq_stack+0x24/0x60 [ 38.028873] do_softirq_own_stack+0x1c/0x40 [ 38.033064] __irq_exit_rcu+0x130/0x15c [ 38.036909] irq_exit_rcu+0x10/0x20 [ 38.040403] el1_interrupt +0x38/0x60 [ 38.043987] el1h_64_irq_handler+0x18/0x24 [ 38.048091] el1h_64_irq+0x6c/0x70 [ 38.051501] default_idle_call+0x34/0xe0 (P) [ 38.055783] do_idle+0x1f8/0x250 [38.059021] cpu_startup_entry+0x34 /0x3c [ 38.062951] rest_init+0xb4/0xc0 [ 38.066186] console_on_rootfs+0x0/0x6c [ 38.070031] __primary_switched+0x88/0x90 [ 38.074059] 程式碼b00037e0 91378000 f9400462 97e9bf49 (d4210000) [ 38.080168]---[結束追踪0000000000000000 ]--- [ 38.084795] 核心錯誤 - 未同步Oops - 錯誤中斷中的嚴重例外狀況 [ 38.092197] ] SMP停止次要 CPU [38.096139] 核心位移停用 [ 38.099631] CPU 功能0x0000,00002000 、02000801、0400420b [38.105202] 記憶體限制無 [ 38.108260] ---[ 結束核心錯誤 - 未同步Oops - 錯誤中斷中的嚴重例外狀況 ]--- (CVE-2025-38619)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - mediatij721e-csi2rx修复 list_del 损坏如果 ti_csi2rx_start_dma() 在 ti_csi2rx_dma_callback() 中失败则缓冲区会标记为“完成”并显示 VB2_BUF_STATE_ERROR但不会从 DMA 队列中删除。这会导致在下一次迭代中重试相同的缓冲区从而导致双重 list_del() 并最终导致列表损坏。若发生错误则调用 vb2_buffer_done() 之前可通过从队列中移除缓冲区修复此问题。这解决了因 list_del 损坏导致的崩溃[ 37.811243] j721e-csi2rx 30102000.ticsi2rx无法排列下一个缓冲区以进行 DMA [ 37.832187] slab kmalloc-2k start ffff00000255b000 指针偏移 1064 大小 2048 [ 37.839761] list_del 损坏。 next->prev 应为 ffff00000255bc28但实际为 ffff00000255d428。 (next=ffff00000255b428) [ 37.850799] ------------[ cut here]------------ [ 37.855424] kernel BUG at lib/list_debug.c:65问题[ 37.859876] 内部错误Oops - 缺陷
    00000000f2000800 [#1] SMP [ 37.866061] Modules linked in: i2c_dev usb_f_rndis u_ether libcomposite dwc3 udc_core usb_common aes_ce_blk aes_ce_cipher ghash_ce gf128mul sha1_ce cpufreq_dt dwc3_am62 phy_gmii_sel sa2ul [ 37.882830] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc3+ #28 VOLUNTARY [ 37.890851] 硬件名称Bosch STLA-GSRV2-B0 (DT) [ 37.895737] pstate600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 37.902703] pc __list_del_entry_valid_or_report+0xdc/0x114 [ 37.908390] lr
    __list_del_entry_valid_or_report+0xdc/0x114 [ 37.914059] sp ffff800080003db0 [ 37.917375] x29
    ffff800080003db0 x280000000000000007 x27ffff800080e50000 [ 37.924521] x260000000000000000 x25
    ffff0000016abb50 x24dead000000000122 [ 37.931666] x23ffff0000016abb78 x22ffff0000016ab080 x21
    ffff800080003de0 [ 37.938810] x20: ffff00000255bc00 x19: ffff00000255b800 x18: 000000000000000a [37.945956] x17: 20747562202c3832 x16: 6362353532303030 x15: 0720072007200720 [ 37.953101] x14:
    0720072007200720 x130720072007200720 x1200000000ffffffea [ 37.960248] x11ffff800080003b18 x10
    00000000ffffefff x9 : ffff800080f5b568 [ 37.967396] x8 : ffff800080f5b5c0 x7 : 0000000000017fe8 x6
    c0000000ffffefff [ 37.974542] x5 : ffff00000fea6688 x4 : 0000000000000000 x3 : 0000000000000000 [37.981686] x2 : 0000000000000000 x1 : ffff800080ef2b40 x0 : 000000000000006d [ 37.988832] Call trace: [37.991281] __list_del_entry_valid_or_report+0xdc/0x114 (P) [ 37.996959] ti_csi2rx_dma_callback+0x84/0x1c4 [ 38.001419] udma_vchan_complete+0x1e0/0x344 [ 38.005705] tasklet_action_common+0x118/0x310 [ 38.010163] tasklet_action+0x30/0x3c [ 38.013832] handle_softirqs+0x10c/0x2e0 [ 38.017761+ 0x14/irq __do20x14/irq [38.021256]____do_softirq+0x10/0x20 [ 38.024931] call_on_irq_stack+0x24/0x60 [ 38.028873] do_softirq_own_stack+0x1c/0x40 [ 38.033064] __irq_exit_rcu+0x130/0x15c [ 38.036909] irq_exit_rcu+0x10/0x20 [ 38.040403] el1_ruptrupt +0x38/0x60 [ 38.043987] el1h_64_irq_handler+0x18/0x24 [ 38.048091] el1h_64_irq+0x6c/0x70 [ 38.051501] default_idle_call+0x34/0xe0 (P) [ 38.055783] do_idle+0x1f8/0x250 [38.059021] cpu_startup_entry+0x34 /0x3c [ 38.062951] rest_init+0xb4/0xc0 [ 38.066186] console_on_rootfs+0x0/0x6c [ 38.070031] __primary_switched+0x88/0x90 [ 38.074059] Codeb00037e0 91378000 f9400462 97e9bf49 (d4210000) [ 38.080168] ---[结束跟踪0000000000000000 ]--- [ 38.084795] 内核错误 - 未同步: Oops - BUG中断中出现致命异常 [ 38.092197] SMP正在停止辅助 CPU [38.096139] 内核偏移已禁用 [ 38.099631] CPU 功能0x0000,00002000 ,02000801,0400420b [38.105202] 内存限制无 [ 38.108260] ---[ 结束内核错误 - 不同步错误 - 缺陷中断中的致命异常 ]--- (CVE-2025-38619)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

ID	Name	Product	Family	Published	Updated	Severity
260245	Linux Distros Unpatched Vulnerability : CVE-2025-38619	Nessus	Misc.	9/2/2025	10/17/2025	medium
260245	Linux Distros のパッチ未適用の脆弱性: CVE-2025-38619	Nessus	Misc.	9/2/2025	10/17/2025	medium
260245	Linux Distros 未修補的弱點：CVE-2025-38619	Nessus	Misc.	9/2/2025	10/17/2025	medium
260245	Linux Distros 未修补的漏洞：CVE-2025-38619	Nessus	Misc.	9/2/2025	10/17/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium