Medium severity5.5NVD Advisory· Published Sep 5, 2025· Updated May 12, 2026

CVE-2025-39709

Description

In the Linux kernel, the following vulnerability has been resolved:

media: venus: protect against spurious interrupts during probe

Make sure the interrupt handler is initialized before the interrupt is registered.

If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a NULL dereference.

This error condition has been observed during system boot on Rb3Gen2.

Affected products

Linux/Linuxv5
Range: 4.13

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlnvdThird Party Advisory
lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlnvdThird Party Advisory
cert-portal.siemens.com/productcert/html/ssa-032379.htmlnvd

News mentions

Siemens SIMATIC
CISA Alerts

Severity

MediumCVSS v3.1

5.5/ 10

Attack vector: Local
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Probability of exploitation in the next 30 days.

0.02%

VYPR risk score

Composite of severity, exploitation, and reach.

0.36medium

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-476
NULL Pointer Dereference

CVE ID

CVE-2025-39709