Use After Free Vulnerability in Linux Kernel Affecting FXLS8962AF Sensor

CVE-2025-38485

What is CVE-2025-38485?

A vulnerability in the Linux kernel has been identified within the FXLS8962AF sensor driver, specifically in the fxls8962af_fifo_flush function. This issue arises when the driver accesses the indio_dev->active_scan_mask without ensuring that the device remains in buffer mode. A potential race condition can occur if the device exits buffer mode during an interrupt that flushes the FIFO, leading to a kernel NULL pointer dereference. The resolution involves adding synchronization to ensure that no interrupt is currently running when disabling buffer mode, thus mitigating the risk associated with this vulnerability.

References