LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39709: media: venus: protect against spurious interrupts during probe

In the Linux kernel, the following vulnerability has been resolved: media: venus: protect against spurious interrupts during probe Make sure the interrupt handler is initialized before the interrupt is registered. If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a NULL dereference. This error condition has been observed during system boot on Rb3Gen2.

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

A startup timing flaw in the Linux Venus media driver can crash the kernel if an interrupt arrives before its handler is fully initialized. The observed consequence is loss of availability, including during system boot. The source bundle reports no confidentiality or integrity impact.

Executive priority

Treat this as a normal-priority availability remediation, elevated for embedded, appliance, or boot-sensitive systems using the Venus driver. It is not supported as an internet-scale or actively exploited threat, but repeated boot failures could disrupt operations. Patch through established kernel or firmware maintenance channels.

Technical view

During driver probe, the IRQ could be registered before hfi_create() completed interrupt-handler initialization. A spurious interrupt in that window could dereference NULL and crash the kernel. The correction initializes the handler before registering the interrupt. CVSS 3.1 is 5.5: local, low-complexity, low-privilege, no user interaction, with high availability impact.

Likely exposure

Exposure is concentrated on Linux systems using the affected Venus media driver, particularly compatible hardware and kernels identified by vendors. The bundle lists affected kernel versions spanning 4.13 through 6.17 and notes the failure on Rb3Gen2. Distributor backports may change actual exposure, so version strings alone are insufficient.

Exploitation context

The supplied record is not in KEV and provides no evidence of active exploitation. Triggering requires local conditions and a narrowly timed interrupt during driver initialization. The failure has been observed during boot, but the sources do not establish deliberate exploitation or reliable attacker control.

Researcher notes

The vulnerability is an initialization-order race in the Venus media driver rather than a general Linux networking flaw. Assessment should correlate driver presence, hardware compatibility, kernel lineage, and vendor backports. The bundle supplies multiple stable-tree corrections but no CWE classification, exploit evidence, or proof that every listed version is exploitable on all hardware.

Mitigation direction

  • Install a vendor or distribution kernel containing the referenced stable fix or an equivalent backport.
  • Confirm appliance and hardware vendors have incorporated the correction into supported firmware or kernels.
  • Prioritize systems using the Venus media driver or showing related boot-time crashes.
  • If updates are unavailable, consult vendor guidance for supported temporary mitigations.

Validation and detection

  • Identify systems loading the Venus media driver and record their running kernel packages.
  • Check distributor or vendor advisories for CVE-2025-39709 backport status.
  • Confirm the applicable stable commit or equivalent change exists in deployed kernel source metadata.
  • Review boot and kernel logs for Venus probe failures, NULL dereferences, or kernel crashes.
  • After updating, perform controlled reboot testing on representative affected hardware.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39709 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
12Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2025-39709Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxaf2c3834c8ca7cc65d15592ac671933df8848115, af2c3834c8ca7cc65d15592ac671933df8848115, af2c3834c8ca7cc65d15592ac671933df8848115, af2c3834c8ca7cc65d15592ac671933df8848115, af2c3834c8ca7cc65d15592ac671933df8848115, af2c3834c8ca7cc65d15592ac671933df8848115, af2c3834c8ca7cc65d15592ac671933df8848115, af2c3834c8ca7cc65d15592ac671933df8848115unaffected
LinuxLinux4.13, 0, 5.4.297, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.44, 6.16.4, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.