Security readout for executives and security teams
Plain-English summary
This Linux kernel bug can leave a timer or delayed work item running after probe failure in the tc358743 media I2C driver. That orphaned task can later touch freed memory, potentially causing a kernel crash or unsafe memory behavior on affected systems.
Executive priority
Treat as a targeted kernel reliability and memory-safety issue. Patch through normal kernel maintenance, with higher priority for media, embedded, or hardware-integration systems using this driver.
Technical view
The flaw is a use-after-free in the tc358743 driver probe failure path. state->timer and delayed_work_enable_hotplug may outlive tc358743_state because non-synchronous deletion/cancellation did not guarantee completion before cleanup. The fix uses timer_delete_sync() and cancel_delayed_work_sync().
Likely exposure
Exposure appears limited to Linux systems with the tc358743 media I2C driver present and probed. The source does not show remote reachability, broad default exposure, or affected downstream distribution package status.
Exploitation context
No active exploitation is cited, and KEV is false. The source says the issue was initially found by static analysis, with reproduction performed using an emulated tc358743 device and fault injection.
Researcher notes
The public record provides root cause, KASAN evidence, and stable commit references, but no CVSS, CWE, exploitability assessment, or downstream vendor matrix. Avoid assuming privilege escalation without additional evidence.
Mitigation direction
- Update to a kernel containing the referenced stable fixes.
- Check Linux distribution advisories for backported kernel fixes.
- Prioritize systems using media capture hardware involving tc358743.
- Follow vendor guidance if fixed package availability is unclear.
Validation and detection
- Inventory kernels and confirm whether tc358743 support is built or loaded.
- Compare deployed kernel versions against vendor fixed releases.
- Review boot and kernel logs for tc358743 probe failures or KASAN reports.
- Confirm the synchronous timer and work cancellation patch is present.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 9205fb6e617a
- Linux stable commit 70913586c717
- Linux stable commit 663faf1179db
- Linux stable commit 3d17701c1565
- Linux stable commit 228d06c4cbfc
- Linux stable commit f92181c0e13c
- Linux stable commit f3f3f00bcabb
- Linux stable commit 2610617effb4
- Linux stable commit 79d10f4f21a9
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39995 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9205fb6e617a1c596d9a9ad2a160ee696e09d520CVE reference, Linux
- https://git.kernel.org/stable/c/70913586c717dd25cfbade7a418e92cc9c99398aCVE reference, Linux
- https://git.kernel.org/stable/c/663faf1179db9663a3793c75e9bc869358bad910CVE reference, Linux
- https://git.kernel.org/stable/c/3d17701c156579969470e58b3a906511f8bc018dCVE reference, Linux
- https://git.kernel.org/stable/c/228d06c4cbfc750f1216a3fd91b4693b0766d2f6CVE reference, Linux
- https://git.kernel.org/stable/c/f92181c0e13cad9671d07b15be695a97fc2534a3CVE reference, Linux
- https://git.kernel.org/stable/c/f3f3f00bcabbd2ce0a77a2ac7a6797b8646bfd8bCVE reference, Linux
- https://git.kernel.org/stable/c/2610617effb4454d2f1c434c011ccb5cc7140711CVE reference, Linux
- https://git.kernel.org/stable/c/79d10f4f21a92e459b2276a77be62c59c1502c9dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.