The Linux kernel vulnerability CVE-2025-40165 affects the media driver for NXP i.MX8 ISI. If streamon and streamoff calls are imbalanced, such as when an application exits abruptly, the m2m usage_count does not decrement properly, causing the ISI channel to remain allocated. Furthermore, input line widths exceeding 2K trigger kernel WARN_ON() messages, indicating improper handling. The issue is resolved by relocating streaming preparation and cleanup to the vb2 .prepare_streaming() and .unprepare_streaming() callbacks, enabling correct resource management and allowing the use of standard v4l2_m2m ioctl streamon/streamoff helpers.

This vulnerability can cause resource leakage by preventing the release of ISI channels, potentially leading to denial of service or system instability. The kernel WARN_ON() triggered by large input widths may also cause kernel warnings or crashes. The impact includes confidentiality, integrity, and availability as indicated by the CVSS vector, but no known exploits are reported in the wild.

A fix is available in the Linux kernel that addresses this issue by properly handling streaming preparation and cleanup in the vb2 framework. Users should update to a kernel version that includes this fix. Since this is a kernel-level vulnerability, applying the official patch or upgrading the kernel is the recommended remediation. Patch status is not explicitly stated in the provided data; check the Linux kernel vendor advisory for the exact fixed version and update accordingly.