In the Linux kernel, the following vulnerability has been resolved:
media: venus: protect against spurious interrupts during probe
Make sure the interrupt handler is initialized before the interrupt is registered.
If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a NULL dereference.
This error condition has been observed during system boot on Rb3Gen2.
[
{
"id": "CVE-2025-39709-05083e25",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3200144a2fa4209dc084a19941b9b203b43580f0",
"deprecated": false,
"digest": {
"line_hashes": [
"291490091787668948852466511828478721277",
"17036562235885979525445152211200960007",
"264184962489102313990068945312084971234",
"76244951398012903593103839663210503827",
"130216201250621863048219224306396190345",
"225727100582430506581531148611125341945",
"68709599485268602526514794068169301925",
"56738768408124153650131572446503490968",
"27866425754144168863135376115979607928"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-39709-0ec9278b",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9db6a78bc5e418e0064e2248c8f3b9b9e8418646",
"deprecated": false,
"digest": {
"line_hashes": [
"14099412229467415045713554487820204448",
"148464527199887752562765715984602726827",
"10655346107064858293890976543740492187",
"76244951398012903593103839663210503827",
"130216201250621863048219224306396190345",
"225727100582430506581531148611125341945",
"68709599485268602526514794068169301925",
"56738768408124153650131572446503490968",
"27866425754144168863135376115979607928"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-39709-4699d6ae",
"target": {
"function": "venus_probe",
"file": "drivers/media/platform/qcom/venus/core.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@639eb587f977c02423f4762467055b23902b4131",
"deprecated": false,
"digest": {
"length": 2697.0,
"function_hash": "16296212327911968136442873702834911939"
}
},
{
"id": "CVE-2025-39709-5f2dee63",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18c2b2bd982b8546312c9a7895515672169f28e0",
"deprecated": false,
"digest": {
"line_hashes": [
"238376888634868956420028493200910067102",
"171988994222206693825999134596101962377",
"64880531235424896749243069079601927674",
"221552315706291320217035604662003420705",
"320298625998951681094559801596174324441",
"206423226832065428561780000629901511351",
"203658389692230500795562715247155860806",
"61630277696655524611774037453035613600",
"217306344000721278176000189976683181327"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-39709-7edf4dd0",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e796028b4835af00d9a38ebbb208ec3a6634702a",
"deprecated": false,
"digest": {
"line_hashes": [
"291490091787668948852466511828478721277",
"17036562235885979525445152211200960007",
"264184962489102313990068945312084971234",
"76244951398012903593103839663210503827",
"130216201250621863048219224306396190345",
"225727100582430506581531148611125341945",
"68709599485268602526514794068169301925",
"56738768408124153650131572446503490968",
"27866425754144168863135376115979607928"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-39709-8019c7ed",
"target": {
"function": "venus_probe",
"file": "drivers/media/platform/qcom/venus/core.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9db6a78bc5e418e0064e2248c8f3b9b9e8418646",
"deprecated": false,
"digest": {
"length": 2722.0,
"function_hash": "178524445808796655147351745690091055719"
}
},
{
"id": "CVE-2025-39709-8ac6c75e",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@639eb587f977c02423f4762467055b23902b4131",
"deprecated": false,
"digest": {
"line_hashes": [
"291490091787668948852466511828478721277",
"17036562235885979525445152211200960007",
"264184962489102313990068945312084971234",
"76244951398012903593103839663210503827",
"130216201250621863048219224306396190345",
"225727100582430506581531148611125341945",
"68709599485268602526514794068169301925",
"56738768408124153650131572446503490968",
"27866425754144168863135376115979607928"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-39709-8aed44fb",
"target": {
"function": "venus_probe",
"file": "drivers/media/platform/qcom/venus/core.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3200144a2fa4209dc084a19941b9b203b43580f0",
"deprecated": false,
"digest": {
"length": 2879.0,
"function_hash": "328960557336829478340425296346217161791"
}
},
{
"id": "CVE-2025-39709-8fd4e63e",
"target": {
"function": "venus_probe",
"file": "drivers/media/platform/qcom/venus/core.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18c2b2bd982b8546312c9a7895515672169f28e0",
"deprecated": false,
"digest": {
"length": 2306.0,
"function_hash": "309227674263941123457900221293185109333"
}
},
{
"id": "CVE-2025-39709-a60c7bd8",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88cf63c2599761c48dec8f618d57dccf8f6f4b53",
"deprecated": false,
"digest": {
"line_hashes": [
"14099412229467415045713554487820204448",
"148464527199887752562765715984602726827",
"10655346107064858293890976543740492187",
"76244951398012903593103839663210503827",
"130216201250621863048219224306396190345",
"225727100582430506581531148611125341945",
"68709599485268602526514794068169301925",
"56738768408124153650131572446503490968",
"27866425754144168863135376115979607928"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-39709-a6475dd5",
"target": {
"function": "venus_probe",
"file": "drivers/media/platform/qcom/venus/core.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f54be97bc69b1096198b6717c150dec69f2a1b4d",
"deprecated": false,
"digest": {
"length": 2697.0,
"function_hash": "16296212327911968136442873702834911939"
}
},
{
"id": "CVE-2025-39709-bf266a7e",
"target": {
"function": "venus_probe",
"file": "drivers/media/platform/qcom/venus/core.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e796028b4835af00d9a38ebbb208ec3a6634702a",
"deprecated": false,
"digest": {
"length": 2879.0,
"function_hash": "328960557336829478340425296346217161791"
}
},
{
"id": "CVE-2025-39709-c2833fe0",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c"
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f54be97bc69b1096198b6717c150dec69f2a1b4d",
"deprecated": false,
"digest": {
"line_hashes": [
"291490091787668948852466511828478721277",
"17036562235885979525445152211200960007",
"264184962489102313990068945312084971234",
"76244951398012903593103839663210503827",
"130216201250621863048219224306396190345",
"225727100582430506581531148611125341945",
"68709599485268602526514794068169301925",
"56738768408124153650131572446503490968",
"27866425754144168863135376115979607928"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-39709-db9ea580",
"target": {
"function": "venus_probe",
"file": "drivers/media/platform/qcom/venus/core.c"
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88cf63c2599761c48dec8f618d57dccf8f6f4b53",
"deprecated": false,
"digest": {
"length": 2722.0,
"function_hash": "178524445808796655147351745690091055719"
}
}
]