CVE-2025-39714

In the Linux kernel's usbtv media driver, a race condition exists when the TV standard is changed while streaming is active. Changing from NTSC to PAL increases the resolution stored in the usbtv struct, but the video plane buffer is not correspondingly adjusted, leading to a buffer overflow when copying data to unmapped memory [2][3][4].

An attacker with local access can trigger this by having one program streaming (e.g., ffplay) while another program (e.g., qv4l2) changes the TV standard. No special privileges beyond the ability to access the video device are required, but the attack requires two concurrent processes interacting with the same usbtv device.

The overflow causes a kernel crash (denial of service). The vulnerability does not appear to allow privilege escalation or code execution based on the description.

The fix adds proper locking and uses vb2_is_busy to prevent resolution changes while the buffer is in use. Patches have been applied to the Linux kernel stable branches [2][3][4]. Users should update to a patched kernel version.