Status: UPDATED | Advisory ID: CVE-2025-54601
| CVE | CVE-2025-54601 |
| CVSS Score / Version | 7.0 (High) / CVSS v3.1 |
| Updated | 2026-07-24 |
| CVSS Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CVSS Prose | attack vector is local; attack complexity is high; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high. |
| Affected products | see table below |
| Classified as | CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Samsung | exynos_980_firmware | ||
| Samsung | exynos_850_firmware | ||
| Samsung | exynos_1080_firmware | ||
| Samsung | exynos_1280_firmware | ||
| Samsung | exynos_1330_firmware | ||
| Samsung | exynos_1380_firmware | ||
| Samsung | exynos_1480_firmware | ||
| Samsung | exynos_1580_firmware | ||
| Samsung | exynos_w930_firmware | ||
| Samsung | exynos_w920_firmware | ||
| Samsung | exynos_w1000_firmware |
| Subsystems | General OT |
| Sectors | Multiple |
An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor amd Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000. Improper synchronization on a global variable leads to a double free. An attacker can trigger a race condition by invoking an ioctl function concurrently from multiple threads. (NVD)
Monitor Samsung's web page for any future patch releases. See vendor advisory link below.