CVE-2025-54602

View on CVE.org
Published Apr 6, 2026 CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Description
An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000. Improper synchronization on a global variable leads to a use-after-free. An attacker can trigger a race condition by invoking an ioctl function concurrently from multiple threads.

Analysis

AI-generated

Technical impact

An improper synchronization of a global variable in Samsung’s Exynos Wi‑Fi driver creates a use‑after‑free condition. When an attacker invokes the driver’s ioctl function concurrently from multiple threads, a race condition can be triggered, freeing an object that may still be in use.

Affected Systems

The vulnerability affects Samsung Exynos mobile and wearable processors, specifically the 850, 980, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000 families and their associated firmware. No specific firmware version ranges are listed, so any device using these chips with the unpatched driver could be impacted.

Risk and Exploitability

With a CVSS score of 7.0, the flaw is considered moderate severity, and the EPSS score indicates a less than 1 percent chance of exploitation in the wild. The vulnerability is not yet in the CISA KEV catalog. Exploitation requires the ability to send race‑condition inducing ioctl calls to the driver, suggesting a local or device‑based attack surface rather than a network‑exposed vector.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Samsung’s firmware or driver update that patches the use‑after‑free issue.
  • Update the device firmware to the latest Samsung release available at https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54602/
  • If an update is not yet available, disable the Wi‑Fi subsystem on the affected device to prevent the driver from loading.
  • Monitor Samsung security advisories for further patches or recommendations related to this CVE.

Generated by OpenCVE AI on April 7, 2026 at 22:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Use-After-Free Vulnerability in Samsung Exynos Wi-Fi Driver
Type Values Removed Values Added
First Time appeared Samsung exynos 1080
Samsung exynos 1080 Firmware
Samsung exynos 1280
Samsung exynos 1280 Firmware
Samsung exynos 1330
Samsung exynos 1330 Firmware
Samsung exynos 1380
Samsung exynos 1380 Firmware
Samsung exynos 1480
Samsung exynos 1480 Firmware
Samsung exynos 1580
Samsung exynos 1580 Firmware
Samsung exynos 850
Samsung exynos 850 Firmware
Samsung exynos 980
Samsung exynos 980 Firmware
Samsung exynos W1000
Samsung exynos W1000 Firmware
Samsung exynos W920
Samsung exynos W920 Firmware
Samsung exynos W930
Samsung exynos W930 Firmware
CPEs cpe:2.3:h:samsung:exynos_1080:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_1280:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_1330:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_1380:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_1480:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_1580:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_850:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_980:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_w1000:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_w920:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:exynos_w930:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_1080_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_1280_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_1330_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_1380_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_1480_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_1580_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_850_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_980_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_w1000_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_w920_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:exynos_w930_firmware:-:*:*:*:*:*:*:*
Vendors & Products Samsung exynos 1080
Samsung exynos 1080 Firmware
Samsung exynos 1280
Samsung exynos 1280 Firmware
Samsung exynos 1330
Samsung exynos 1330 Firmware
Samsung exynos 1380
Samsung exynos 1380 Firmware
Samsung exynos 1480
Samsung exynos 1480 Firmware
Samsung exynos 1580
Samsung exynos 1580 Firmware
Samsung exynos 850
Samsung exynos 850 Firmware
Samsung exynos 980
Samsung exynos 980 Firmware
Samsung exynos W1000
Samsung exynos W1000 Firmware
Samsung exynos W920
Samsung exynos W920 Firmware
Samsung exynos W930
Samsung exynos W930 Firmware
Type Values Removed Values Added
First Time appeared Samsung
Samsung exynos
Vendors & Products Samsung
Samsung exynos
Type Values Removed Values Added
Title Use-After-Free Vulnerability in Samsung Exynos Wi-Fi Driver
Type Values Removed Values Added
Weaknesses CWE-362
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000. Improper synchronization on a global variable leads to a use-after-free. An attacker can trigger a race condition by invoking an ioctl function concurrently from multiple threads.
References
Earlier changes (1)
Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Apr 6, 2026, 7:52 PM
Reserved
Jul 27, 2025, 12:00 AM

View source JSON

Updated
Apr 6, 2026, 7:49 PM

JSON

Status
Analyzed
Published
Apr 6, 2026, 8:16 PM
Modified
Jul 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Apr 8, 2026, 7:52 PM

JSON