{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39709", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.116Z", "datePublished": "2025-09-05T17:21:16.153Z", "dateUpdated": "2026-08-05T12:04:44.157Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:04:44.157Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: protect against spurious interrupts during probe\n\nMake sure the interrupt handler is initialized before the interrupt is\nregistered.\n\nIf the IRQ is registered before hfi_create(), it's possible that an\ninterrupt fires before the handler setup is complete, leading to a NULL\ndereference.\n\nThis error condition has been observed during system boot on Rb3Gen2." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "scenarios": [ { "lang": "en", "value": "AV:L - The flaw is in a Qualcomm SoC platform driver reached only through on-device driver probe (boot, module autoload, or sysfs bind), with no network or remote-peer data path. Exposure requires being on the local machine, so Local is the highest defensible vector.\nAC:L - The IRQ is registered level-triggered (IRQF_TRIGGER_HIGH), so an already-asserted Venus line invokes hfi_isr immediately and deterministically, and the race window is widened by a sleeping GFP_KERNEL allocation inside hfi_create(). The condition was observed reproducibly on Rb3Gen2 during ordinary system boot, requiring no special memory layout or non-default config.\nPR:L - Only local presence on the affected device is needed — the venus module is autoloaded and probed on Qualcomm platforms, and the panic occurs during that probe without any capability being exercised. It is not High because no root-only capability is inherent to reaching the faulting path.\nUI:N - The spurious interrupt fires during driver probe with no victim action of any kind; no user must open a device, mount media, or run a codec session.\nS:U - The NULL dereference and the resulting panic are contained within the kernel of the same machine, crossing no VM, hypervisor, or IOMMU boundary.\nC:N - The fault is a read of the fixed NULL-page offset 0xb0 (offsetof(struct hfi_ops, isr)) that immediately traps; no attacker-influenced data is read back or exposed to userspace.\nI:N - No memory is written, no object is corrupted, and no type confusion or overflow occurs — the call target is never reached because the load itself faults, so no control-flow hijack or data modification results.\nA:H - The NULL function-pointer dereference happens in hard IRQ context, where oops_end()/in_interrupt() escalates to panic(\"Fatal exception in interrupt\"), producing an unconditional kernel panic and denial of boot on affected Qualcomm devices." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/platform/qcom/venus/core.c" ], "versions": [ { "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "lessThan": "18c2b2bd982b8546312c9a7895515672169f28e0", "status": "affected", "versionType": "git" }, { "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "lessThan": "88cf63c2599761c48dec8f618d57dccf8f6f4b53", "status": "affected", "versionType": "git" }, { "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "lessThan": "9db6a78bc5e418e0064e2248c8f3b9b9e8418646", "status": "affected", "versionType": "git" }, { "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "lessThan": "37cc0ac889b018097c217c5929fd6dc2aed636a1", "status": "affected", "versionType": "git" }, { "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "lessThan": "f54be97bc69b1096198b6717c150dec69f2a1b4d", "status": "affected", "versionType": "git" }, { "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "lessThan": "639eb587f977c02423f4762467055b23902b4131", "status": "affected", "versionType": "git" }, { "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "lessThan": "e796028b4835af00d9a38ebbb208ec3a6634702a", "status": "affected", "versionType": "git" }, { "version": "af2c3834c8ca7cc65d15592ac671933df8848115", "lessThan": "3200144a2fa4209dc084a19941b9b203b43580f0", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/platform/qcom/venus/core.c" ], "versions": [ { "version": "4.13", "status": "affected" }, { "version": "0", "lessThan": "4.13", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.297", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.241", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.190", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.149", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.103", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.44", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.4", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "5.4.297" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "5.10.241" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "5.15.190" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.1.149" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.6.103" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.12.44" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.16.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/18c2b2bd982b8546312c9a7895515672169f28e0" }, { "url": "https://git.kernel.org/stable/c/88cf63c2599761c48dec8f618d57dccf8f6f4b53" }, { "url": "https://git.kernel.org/stable/c/9db6a78bc5e418e0064e2248c8f3b9b9e8418646" }, { "url": "https://git.kernel.org/stable/c/37cc0ac889b018097c217c5929fd6dc2aed636a1" }, { "url": "https://git.kernel.org/stable/c/f54be97bc69b1096198b6717c150dec69f2a1b4d" }, { "url": "https://git.kernel.org/stable/c/639eb587f977c02423f4762467055b23902b4131" }, { "url": "https://git.kernel.org/stable/c/e796028b4835af00d9a38ebbb208ec3a6634702a" }, { "url": "https://git.kernel.org/stable/c/3200144a2fa4209dc084a19941b9b203b43580f0" } ], "title": "media: venus: protect against spurious interrupts during probe", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:42:35.451Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T12:06:27.910Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [ { "status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ] } ] } }