CVE-2025-39709: media: venus: protect against spurious interrupts during probe
In the Linux kernel, the following vulnerability has been resolved:
media: venus: protect against spurious interrupts during probe
Make sure the interrupt handler is initialized before the interrupt is registered.
If the IRQ is registered before hficreate(), it's possible that an interrupt fires before the handler setup is complete, leading to a NULL dereference.
This error condition has been observed during system boot on Rb3Gen2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Initialize the interrupt handler before registering the IRQ in the Venus media driver's probe path to prevent spurious interrupts from causing a NULL dereference.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39709?
CVE-2025-39709 has been classified as a medium severity vulnerability due to the potential for system instability.
How do I fix CVE-2025-39709?
To fix CVE-2025-39709, ensure that the interrupt handler is initialized before registering the interrupt in the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2025-39709?
CVE-2025-39709 affects certain versions of the Linux kernel, particularly those utilizing the venus media driver.
What impact does CVE-2025-39709 have on system performance?
CVE-2025-39709 may lead to spurious interrupts, which can negatively affect system performance and stability.
Is CVE-2025-39709 part of a larger trend in Linux kernel vulnerabilities?
Yes, CVE-2025-39709 is part of ongoing efforts to improve the stability and security of the Linux kernel against interrupt-related vulnerabilities.