Security readout for executives and security teams
Plain-English summary
A local user could crash or corrupt a Linux system using the USBTV video driver by changing the television standard while video is streaming. The change increases resolution without resizing an existing buffer, causing an overflow. Exposure is limited to systems using this driver and permitting local access to the capture device.
Executive priority
Treat as a high-priority endpoint and appliance update where USBTV capture is used or accessible to untrusted local users. Broader urgency is lower for systems without the usbtv driver or relevant hardware. Because the supplied version mapping is unclear, require asset-specific confirmation rather than assuming a kernel branch is safe.
Technical view
CVE-2025-39714 is a local Linux kernel memory-safety flaw in the usbtv media driver. A concurrent NTSC-to-PAL change can enlarge the stored resolution while the active video-plane buffer remains unchanged, causing an out-of-bounds copy into unmapped memory. Linux stable commits prevent resolution changes while the video-buffer queue is busy.
Likely exposure
Likely exposure is concentrated on Linux systems using the usbtv driver for USB television capture. Exploitation requires local, low-privileged access and the ability to interact with the relevant video device while streaming. The supplied affected-version data spans multiple kernel branches but is ambiguous; confirm status using the distribution or appliance vendor's package guidance.
Exploitation context
The CVSS 3.1 score is 7.8 with local attack access, low complexity, low privileges, and no user interaction. The documented outcome is a kernel crash from memory corruption. The source bundle reports that this CVE is not in KEV and provides no evidence of active exploitation; this does not prove exploitation has never occurred.
Researcher notes
The central invariant is that video resolution must not change while buffers are allocated or in use. The fix uses the video-buffer queue's busy state, not only its streaming state. The bundle contains repeated and unclear affected-version entries, so downstream backports and package changelogs are more reliable for validation than version-number inference alone.
Mitigation direction
- Apply a vendor-supported kernel update containing the applicable Linux stable fix.
- Check distribution or appliance vendor guidance for exact fixed package versions before deployment.
- Prioritize remediation where untrusted local users can access USBTV capture devices.
Validation and detection
- Inventory systems loading or packaging the usbtv driver and identify attached USBTV capture hardware.
- Compare each running kernel package with its distribution or appliance vendor's fixed-version guidance.
- Confirm the updated kernel is running after installation and any required reboot.
- Review permissions governing local access to affected video capture devices.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39714 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c35e7c7a004ef379a1ae7c7486d4829419acad1dCVE reference, Linux
- https://git.kernel.org/stable/c/ee7bade8b9244834229b12b6e1e724939bedd484CVE reference, Linux
- https://git.kernel.org/stable/c/5427dda195d6baf23028196fd55a0c90f66ffa61CVE reference, Linux
- https://git.kernel.org/stable/c/ef9b3c22405192afaa279077ddd45a51db90b83dCVE reference, Linux
- https://git.kernel.org/stable/c/3d83d0b5ae5045a7a246ed116b5f6c688a12f9e9CVE reference, Linux
- https://git.kernel.org/stable/c/c3d75524e10021aa5c223d94da4996640aed46c0CVE reference, Linux
- https://git.kernel.org/stable/c/9f886d21e235c4bd038cb20f6696084304197ab3CVE reference, Linux
- https://git.kernel.org/stable/c/7e40e0bb778907b2441bff68d73c3eb6b6cd319fCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.