{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39714","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.117Z","datePublished":"2025-09-05T17:21:21.435Z","dateUpdated":"2026-08-05T12:04:47.367Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:04:47.367Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: usbtv: Lock resolution while streaming\n\nWhen an program is streaming (ffplay) and another program (qv4l2)\nchanges the TV standard from NTSC to PAL, the kernel crashes due to trying\nto copy to unmapped memory.\n\nChanging from NTSC to PAL increases the resolution in the usbtv struct,\nbut the video plane buffer isn't adjusted, so it overflows.\n\n[hverkuil: call vb2_is_busy instead of vb2_is_streaming]"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation is entirely through local ioctls (VIDIOC_REQBUFS, VIDIOC_S_STD, VIDIOC_STREAMON) on the /dev/videoN character device node exposed by the usbtv driver; the attacker needs no physical access, only a local account on a system where a USBTV007 capture device is attached (video ingest appliances, kiosks, digitization/surveillance stations).\nAC:L - The attacker controls every step and no race is needed — buffers are sized once at REQBUFS and queue_setup is never re-run at STREAMON, so a single-threaded sequence of REQBUFS (default NTSC 720x480) then S_STD(PAL/SECAM 720x576) then STREAMON deterministically makes n_chunks exceed the allocated plane size, and the v4l2 core imposes no streaming/busy gate on S_STD.\nPR:L - Only an open file descriptor on the V4L2 device node is needed; v4l_s_std() and video_ioctl2() enforce no capability check, and the node is reachable by any unprivileged user in the video group or the console user via systemd-logind uaccess ACLs.\nUI:N - A single attacker-controlled process performs the allocation, standard change and stream start itself; the two-program scenario in the commit message (ffplay plus qv4l2) is merely how it was observed, not a requirement.\nS:U - The out-of-bounds write corrupts kernel memory within the same kernel security authority, with no crossing of a VM, IOMMU or sandbox boundary.\nC:H - The ~138 KB out-of-bounds write into vmalloc space can corrupt adjacent allocations — other vb2 planes, VMAP_STACK kernel stacks, BPF JIT pages, module data — and such corruption of neighboring pointers, length fields and control flow is leverageable into arbitrary kernel memory disclosure.\nI:H - This is an out-of-bounds heap write of up to ~138 KB past the vmalloc_user() plane, with the written bytes taken from the ISO video payload that an attacker controlling the analog input or emulating the USBTV007 device can fully choose, yielding a control-flow hijack primitive against adjacent vmalloc objects.\nA:H - The write reliably hits the vmalloc guard page and faults on unmapped memory inside the ISO URB completion handler under spin_lock_irqsave, producing the kernel oops/panic explicitly reported in the fix commit."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/usb/usbtv/usbtv-video.c"],"versions":[{"version":"0e0fe3958fdd13dbf55c3a787acafde6efd04272","lessThan":"c35e7c7a004ef379a1ae7c7486d4829419acad1d","status":"affected","versionType":"git"},{"version":"0e0fe3958fdd13dbf55c3a787acafde6efd04272","lessThan":"ee7bade8b9244834229b12b6e1e724939bedd484","status":"affected","versionType":"git"},{"version":"0e0fe3958fdd13dbf55c3a787acafde6efd04272","lessThan":"5427dda195d6baf23028196fd55a0c90f66ffa61","status":"affected","versionType":"git"},{"version":"0e0fe3958fdd13dbf55c3a787acafde6efd04272","lessThan":"ef9b3c22405192afaa279077ddd45a51db90b83d","status":"affected","versionType":"git"},{"version":"0e0fe3958fdd13dbf55c3a787acafde6efd04272","lessThan":"3d83d0b5ae5045a7a246ed116b5f6c688a12f9e9","status":"affected","versionType":"git"},{"version":"0e0fe3958fdd13dbf55c3a787acafde6efd04272","lessThan":"c3d75524e10021aa5c223d94da4996640aed46c0","status":"affected","versionType":"git"},{"version":"0e0fe3958fdd13dbf55c3a787acafde6efd04272","lessThan":"9f886d21e235c4bd038cb20f6696084304197ab3","status":"affected","versionType":"git"},{"version":"0e0fe3958fdd13dbf55c3a787acafde6efd04272","lessThan":"7e40e0bb778907b2441bff68d73c3eb6b6cd319f","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/usb/usbtv/usbtv-video.c"],"versions":[{"version":"3.14","status":"affected"},{"version":"0","lessThan":"3.14","status":"unaffected","versionType":"semver"},{"version":"5.4.297","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.241","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.190","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.149","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.103","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.44","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.16.4","lessThanOrEqual":"6.16.*","status":"unaffected","versionType":"semver"},{"version":"6.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"5.4.297"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"5.10.241"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"5.15.190"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"6.1.149"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"6.6.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"6.12.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"6.16.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"6.17"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/c35e7c7a004ef379a1ae7c7486d4829419acad1d"},{"url":"https://git.kernel.org/stable/c/ee7bade8b9244834229b12b6e1e724939bedd484"},{"url":"https://git.kernel.org/stable/c/5427dda195d6baf23028196fd55a0c90f66ffa61"},{"url":"https://git.kernel.org/stable/c/ef9b3c22405192afaa279077ddd45a51db90b83d"},{"url":"https://git.kernel.org/stable/c/3d83d0b5ae5045a7a246ed116b5f6c688a12f9e9"},{"url":"https://git.kernel.org/stable/c/c3d75524e10021aa5c223d94da4996640aed46c0"},{"url":"https://git.kernel.org/stable/c/9f886d21e235c4bd038cb20f6696084304197ab3"},{"url":"https://git.kernel.org/stable/c/7e40e0bb778907b2441bff68d73c3eb6b6cd319f"}],"title":"media: usbtv: Lock resolution while streaming","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T17:42:41.101Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T12:06:31.361Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC CN 4100","versions":[{"status":"affected","version":"0","lessThan":"V5.0","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]}]}}