CVE-2025-39774: iio: adc: rzg2l_adc: Set driver data before enabling runtime PM
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: rzg2ladc: Set driver data before enabling runtime PM
When stress-testing the system by repeatedly unbinding and binding the ADC device in a loop, and the ADC is a supplier for another device (e.g., a thermal hardware block that reads temperature through the ADC), it may happen that the ADC device is runtime-resumed immediately after runtime PM is enabled, triggered by its consumer. At this point, since drvdata is not yet set and the driver's runtime PM callbacks rely on it, a crash can occur. To avoid this, set drvdata just after it was allocated.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39774?
CVE-2025-39774 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-39774?
To fix CVE-2025-39774, update your Linux kernel to the latest version that includes the patch provided for this vulnerability.
What impact does CVE-2025-39774 have on system performance?
CVE-2025-39774 may lead to performance degradation when repeatedly unbinding and binding the ADC device under certain stress conditions.
Which versions of the Linux kernel are affected by CVE-2025-39774?
CVE-2025-39774 affects multiple versions of the Linux kernel, particularly those versions that include the vulnerable ADC driver.
Can CVE-2025-39774 be exploited remotely?
CVE-2025-39774 does not allow for remote exploitation, as it involves local access to the system's hardware through the ADC driver.