CVE-2025-39714: media: usbtv: Lock resolution while streaming
In the Linux kernel, the following vulnerability has been resolved:
media: usbtv: Lock resolution while streaming
When an program is streaming (ffplay) and another program (qv4l2) changes the TV standard from NTSC to PAL, the kernel crashes due to trying to copy to unmapped memory.
Changing from NTSC to PAL increases the resolution in the usbtv struct, but the video plane buffer isn't adjusted, so it overflows.
[hverkuil: call vb2isbusy instead of vb2isstreaming]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Lock the resolution and prevent changing the TV standard from NTSC to PAL while streaming.
Linux kernel media usbtv driver TV standard/resolution while streaming = locked
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39714?
CVE-2025-39714 has a high severity due to the kernel crash when changing TV standards while streaming.
How do I fix CVE-2025-39714?
To fix CVE-2025-39714, update to the latest stable version of the Linux kernel that includes the vulnerability resolution.
What systems are affected by CVE-2025-39714?
CVE-2025-39714 affects the Linux Kernel across various distributions that utilize the usbtv media driver.
What causes CVE-2025-39714?
CVE-2025-39714 is caused by a race condition when streaming video and changing the TV standard, leading to attempts to access unmapped memory.
Is CVE-2025-39714 being actively exploited?
As of now, there are no public reports indicating active exploitation of CVE-2025-39714.