Security readout for executives and security teams
Plain-English summary
A Linux MediaTek graphics-driver bug could release a device-tree object too many times, potentially letting the kernel use freed memory. The supplied CVSS score is 8.4 because successful abuse could affect confidentiality, integrity, and availability. However, exploitation requires local access, and the sources do not establish practical exploitability or attacks in the wild.
Executive priority
Treat as a high-priority kernel maintenance issue on MediaTek-based Linux systems, especially shared or physically accessible devices. Accelerate inventory and patch verification, but avoid declaring an emergency solely from the CVSS score because active exploitation is unsupported and exact affected ranges are incomplete.
Technical view
The drm/mediatek code added an unnecessary of_node_put() during for_each_child_of_node() iteration. Because the iterator already drops each child-node reference, the extra decrement could prematurely free an OF node and cause a kernel use-after-free. The referenced stable commits remove that decrement.
Likely exposure
Exposure is limited to Linux kernels containing the flawed MediaTek DRM code before the applicable stable fix. Systems not using the affected driver may have lower practical exposure. The bundle marks Linux 6.6.105, 6.12.45, 6.16.5, and four listed commit versions as unaffected, but provides no complete affected-version ranges.
Exploitation context
The CVSS vector indicates local attack access, low complexity, no privileges, and no user interaction. CVE-2025-39882 is not listed as KEV in the supplied bundle, and no provided source reports active exploitation, public proof-of-concept code, or confirmed weaponization.
Researcher notes
The weakness is CWE-416 and arises from incorrect reference-count ownership during OF child iteration. Assess reachability through MediaTek display initialization and vendor-specific backports. The bundle identifies fix commits and known-unaffected versions but does not provide introduction commits, complete vulnerable ranges, crash evidence, or exploitation research.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable referenced stable fix.
- Prioritize systems using MediaTek DRM hardware or loading the associated driver.
- Confirm vendor backports when package versions differ from upstream kernel versions.
- Review current Linux distribution or device-vendor security guidance before deployment.
Validation and detection
- Record each system's kernel package, build identifier, hardware platform, and loaded MediaTek DRM modules.
- Verify the installed source or vendor changelog contains the applicable referenced fix.
- Confirm versions 6.6.105, 6.12.45, or 6.16.5 are not vendor-modified vulnerable builds.
- Retest normal display initialization and stability after applying the kernel update.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-39882 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.55.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.4HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1dCVE reference, Linux
- https://git.kernel.org/stable/c/b58a26cdd4795c1ce6a80e38e9348885555dacd6CVE reference, Linux
- https://git.kernel.org/stable/c/c4901802ed1ce859242e10af06e6a7752cba0497CVE reference, Linux
- https://git.kernel.org/stable/c/4de37a48b6b58faaded9eb765047cf0d8785ea18CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.