CVE-2025-39712: media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
In the Linux kernel, the following vulnerability has been resolved:
media: mt9m114: Fix deadlock in getframeinterval/setframeinterval
Getting / Setting the frame interval using the V4L2 subdev pad ops getframeinterval/setframeinterval causes a deadlock, as the subdev state is locked in the [1] but also in the driver itself.
In [2] it's described that the caller is responsible to acquire and release the lock in this case. Therefore, acquiring the lock in the driver is wrong.
Remove the lock acquisitions/releases from mt9m114ifpgetframeinterval() and mt9m114ifpsetframeinterval().
[1] drivers/media/v4l2-core/v4l2-subdev.c - line 1129 [2] Documentation/driver-api/media/v4l2-subdev.rst
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the mt9m114 driver, remove the lock acquisitions and releases from mt9m114_ifp_get_frame_interval() and mt9m114_ifp_set_frame_interval(); the V4L2 subdev pad operations caller is responsible for managing the subdev state lock.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39712?
CVE-2025-39712 has been classified with a moderate severity level due to the potential for deadlocks in the Linux kernel.
How do I fix CVE-2025-39712?
To fix CVE-2025-39712, update your Linux kernel to the latest patched version provided by your Linux distribution.
What systems are affected by CVE-2025-39712?
CVE-2025-39712 affects various versions of the Linux kernel using the mt9m114 media driver.
What is the nature of the vulnerability in CVE-2025-39712?
CVE-2025-39712 involves a deadlock condition when getting or setting frame intervals through V4L2 subdev pad operations.
Can CVE-2025-39712 be exploited remotely?
CVE-2025-39712 does not present a direct remote exploitation vector but may impact applications relying on the vulnerable kernel functionality.