Security readout for executives and security teams
Plain-English summary
Removing an iMON USB device while it is being used can leave the Linux kernel accessing freed memory. This may cause a crash, data corruption, or possible local compromise. Exposure depends on the affected iMON driver path being available; this is not presented as a remotely reachable flaw.
Executive priority
Prioritize near-term kernel remediation for systems using iMON devices, especially multi-user or otherwise untrusted local environments. Treat other systems as inventory-driven rather than an internet-wide emergency. Confirm vendor backports before declaring systems fixed because the supplied branch data is not sufficient for exact package-level conclusions.
Technical view
A race in the iMON media remote-control driver allows imon_disconnect() to release a usb_device reference while writer operations still use usbdev_intf0 or usbdev_intf1. The resulting use-after-free was observed by KASAN. The fix synchronizes a disconnected flag under ictx->lock and returns -ENODEV from affected writer and open paths.
Likely exposure
Most likely exposure is on Linux systems using, or permitting access to, supported iMON USB hardware and the associated driver. The supplied version data spans several kernel branches but does not clearly map distribution backports. The CVSS vector requires local access with low privileges; internet exposure alone does not establish vulnerability.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. Discovery came from Syzkaller with KASAN. Exploitation would require locally reaching the iMON driver while device disconnection races an active operation; practical reliability is not established.
Researcher notes
The flaw centers on usb_device lifetime management during imon_disconnect(). Relevant paths include send_packet(), vfd_write(), lcd_write(), and display_open(). The supplied fix checks ictx->disconnected under ictx->lock before USB cleanup continues. The bundle provides no CWE assignment, public exploit evidence, or proof that the CVSS confidentiality and integrity impacts are practically achievable.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable upstream stable fix for CVE-2025-39993.
- Confirm distribution backport status because kernel package versions may not directly match upstream version labels.
- If updating is delayed, request vendor-supported mitigation guidance; the sources name no alternative workaround.
Validation and detection
- Inventory installed kernel and distribution package versions across systems using iMON hardware.
- Determine whether the iMON driver and compatible USB hardware are present and operational.
- Verify the installed kernel includes synchronized disconnected checks in the affected writer and open paths.
- Review kernel logs for use-after-free or KASAN reports involving imon.c after device disconnection.
- Test normal iMON use and disconnection after updating, monitoring for crashes or sanitizer findings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39993 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9348976003e39754af344949579e824a0a210fc4CVE reference, Linux
- https://git.kernel.org/stable/c/b03fac6e2a38331faf8510b480becfa90cea1c9fCVE reference, Linux
- https://git.kernel.org/stable/c/71c52b073922d05e79e6de7fc7f5f38f927929a4CVE reference, Linux
- https://git.kernel.org/stable/c/71096a6161a25e84acddb89a9d77f138502d26abCVE reference, Linux
- https://git.kernel.org/stable/c/71da40648741d15b302700b68973fe8b382aef3cCVE reference, Linux
- https://git.kernel.org/stable/c/fd5d3e6b149ec8cce045d86a2b5e3664d6b32ba5CVE reference, Linux
- https://git.kernel.org/stable/c/d9f6ce99624a41c3bcb29a8d7d79b800665229ddCVE reference, Linux
- https://git.kernel.org/stable/c/2e7fd93b9cc565b839bc55a6662475718963e156CVE reference, Linux
- https://git.kernel.org/stable/c/fa0f61cc1d828178aa921475a9b786e7fbb65ccbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.