CVE-2025-39709 (GCVE-0-2025-39709)
Vulnerability from cvelistv5
Published
2025-09-05 17:21
Modified
2026-08-05 12:04
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: media: venus: protect against spurious interrupts during probe Make sure the interrupt handler is initialized before the interrupt is registered. If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a NULL dereference. This error condition has been observed during system boot on Rb3Gen2.
References
Impacted products
Vendor Product Version
Linux Linux Version: af2c3834c8ca7cc65d15592ac671933df8848115
Version: af2c3834c8ca7cc65d15592ac671933df8848115
Version: af2c3834c8ca7cc65d15592ac671933df8848115
Version: af2c3834c8ca7cc65d15592ac671933df8848115
Version: af2c3834c8ca7cc65d15592ac671933df8848115
Version: af2c3834c8ca7cc65d15592ac671933df8848115
Version: af2c3834c8ca7cc65d15592ac671933df8848115
Version: af2c3834c8ca7cc65d15592ac671933df8848115
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:42:35.451Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:06:27.910Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/qcom/venus/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "18c2b2bd982b8546312c9a7895515672169f28e0",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "88cf63c2599761c48dec8f618d57dccf8f6f4b53",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "9db6a78bc5e418e0064e2248c8f3b9b9e8418646",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "37cc0ac889b018097c217c5929fd6dc2aed636a1",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "f54be97bc69b1096198b6717c150dec69f2a1b4d",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "639eb587f977c02423f4762467055b23902b4131",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "e796028b4835af00d9a38ebbb208ec3a6634702a",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "3200144a2fa4209dc084a19941b9b203b43580f0",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/qcom/venus/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: protect against spurious interrupts during probe\n\nMake sure the interrupt handler is initialized before the interrupt is\nregistered.\n\nIf the IRQ is registered before hfi_create(), it\u0027s possible that an\ninterrupt fires before the handler setup is complete, leading to a NULL\ndereference.\n\nThis error condition has been observed during system boot on Rb3Gen2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in a Qualcomm SoC platform driver reached only through on-device driver probe (boot, module autoload, or sysfs bind), with no network or remote-peer data path. Exposure requires being on the local machine, so Local is the highest defensible vector.\nAC:L - The IRQ is registered level-triggered (IRQF_TRIGGER_HIGH), so an already-asserted Venus line invokes hfi_isr immediately and deterministically, and the race window is widened by a sleeping GFP_KERNEL allocation inside hfi_create(). The condition was observed reproducibly on Rb3Gen2 during ordinary system boot, requiring no special memory layout or non-default config.\nPR:L - Only local presence on the affected device is needed \u2014 the venus module is autoloaded and probed on Qualcomm platforms, and the panic occurs during that probe without any capability being exercised. It is not High because no root-only capability is inherent to reaching the faulting path.\nUI:N - The spurious interrupt fires during driver probe with no victim action of any kind; no user must open a device, mount media, or run a codec session.\nS:U - The NULL dereference and the resulting panic are contained within the kernel of the same machine, crossing no VM, hypervisor, or IOMMU boundary.\nC:N - The fault is a read of the fixed NULL-page offset 0xb0 (offsetof(struct hfi_ops, isr)) that immediately traps; no attacker-influenced data is read back or exposed to userspace.\nI:N - No memory is written, no object is corrupted, and no type confusion or overflow occurs \u2014 the call target is never reached because the load itself faults, so no control-flow hijack or data modification results.\nA:H - The NULL function-pointer dereference happens in hard IRQ context, where oops_end()/in_interrupt() escalates to panic(\"Fatal exception in interrupt\"), producing an unconditional kernel panic and denial of boot on affected Qualcomm devices."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:44.157Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/18c2b2bd982b8546312c9a7895515672169f28e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/88cf63c2599761c48dec8f618d57dccf8f6f4b53"
        },
        {
          "url": "https://git.kernel.org/stable/c/9db6a78bc5e418e0064e2248c8f3b9b9e8418646"
        },
        {
          "url": "https://git.kernel.org/stable/c/37cc0ac889b018097c217c5929fd6dc2aed636a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f54be97bc69b1096198b6717c150dec69f2a1b4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/639eb587f977c02423f4762467055b23902b4131"
        },
        {
          "url": "https://git.kernel.org/stable/c/e796028b4835af00d9a38ebbb208ec3a6634702a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3200144a2fa4209dc084a19941b9b203b43580f0"
        }
      ],
      "title": "media: venus: protect against spurious interrupts during probe",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39709",
    "datePublished": "2025-09-05T17:21:16.153Z",
    "dateReserved": "2025-04-16T07:20:57.116Z",
    "dateUpdated": "2026-08-05T12:04:44.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.