GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-39994 (GCVE-0-2025-39994)

Vulnerability from cvelistv5 – Published: 2025-10-15 07:58 – Updated: 2026-08-05 12:06
VLAI
Title
media: tuner: xc5000: Fix use-after-free in xc5000_release
Summary
In the Linux kernel, the following vulnerability has been resolved: media: tuner: xc5000: Fix use-after-free in xc5000_release The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep has fully completed if it was already running. This leads to use-after-free scenarios where xc5000_release() may free the xc5000_priv while timer_sleep is still active and attempts to dereference the xc5000_priv. A typical race condition is illustrated below: CPU 0 (release thread) | CPU 1 (delayed work callback) xc5000_release() | xc5000_do_timer_sleep() cancel_delayed_work() | hybrid_tuner_release_state(priv) | kfree(priv) | | priv = container_of() // UAF Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the timer_sleep is properly canceled before the xc5000_priv memory is deallocated. A deadlock concern was considered: xc5000_release() is called in a process context and is not holding any locks that the timer_sleep work item might also need. Therefore, the use of the _sync() variant is safe here. This bug was initially identified through static analysis. [hverkuil: fix typo in Subject: tunner -> tuner]
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 , < bc4ffd962ce16a154c44c68853b9d93f5b6fc4b8 (git)
Affected: f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 , < e2f5eaafc0306a76fb1cb760aae804b065b8a341 (git)
Affected: f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 , < 3f876cd47ed8bca1e28d68435845949f51f90703 (git)
Affected: f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 , < df0303b4839520b84d9367c2fad65b13650a4d42 (git)
Affected: f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 , < 71ed8b81a4906cb785966910f39cf7f5ad60a69e (git)
Affected: f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 , < effb1c19583bca7022fa641a70766de45c6d41ac (git)
Affected: f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 , < 9a00de20ed8ba90888479749b87bc1532cded4ce (git)
Affected: f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 , < 4266f012806fc18e46da4a04d130df59a4946f93 (git)
Affected: f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 , < 40b7a19f321e65789612ebaca966472055dab48c (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.16
Unaffected: 0 , < 3.16 (semver)
Unaffected: 5.4.301 , ≤ 5.4.* (semver)
Unaffected: 5.10.246 , ≤ 5.10.* (semver)
Unaffected: 5.15.195 , ≤ 5.15.* (semver)
Unaffected: 6.1.156 , ≤ 6.1.* (semver)
Unaffected: 6.6.111 , ≤ 6.6.* (semver)
Unaffected: 6.12.51 , ≤ 6.12.* (semver)
Unaffected: 6.16.11 , ≤ 6.16.* (semver)
Unaffected: 6.17.1 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/tuners/xc5000.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bc4ffd962ce16a154c44c68853b9d93f5b6fc4b8",
              "status": "affected",
              "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
              "versionType": "git"
            },
            {
              "lessThan": "e2f5eaafc0306a76fb1cb760aae804b065b8a341",
              "status": "affected",
              "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
              "versionType": "git"
            },
            {
              "lessThan": "3f876cd47ed8bca1e28d68435845949f51f90703",
              "status": "affected",
              "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
              "versionType": "git"
            },
            {
              "lessThan": "df0303b4839520b84d9367c2fad65b13650a4d42",
              "status": "affected",
              "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
              "versionType": "git"
            },
            {
              "lessThan": "71ed8b81a4906cb785966910f39cf7f5ad60a69e",
              "status": "affected",
              "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
              "versionType": "git"
            },
            {
              "lessThan": "effb1c19583bca7022fa641a70766de45c6d41ac",
              "status": "affected",
              "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
              "versionType": "git"
            },
            {
              "lessThan": "9a00de20ed8ba90888479749b87bc1532cded4ce",
              "status": "affected",
              "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
              "versionType": "git"
            },
            {
              "lessThan": "4266f012806fc18e46da4a04d130df59a4946f93",
              "status": "affected",
              "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
              "versionType": "git"
            },
            {
              "lessThan": "40b7a19f321e65789612ebaca966472055dab48c",
              "status": "affected",
              "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/tuners/xc5000.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.111",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.51",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.11",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.1",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: tuner: xc5000: Fix use-after-free in xc5000_release\n\nThe original code uses cancel_delayed_work() in xc5000_release(), which\ndoes not guarantee that the delayed work item timer_sleep has fully\ncompleted if it was already running. This leads to use-after-free scenarios\nwhere xc5000_release() may free the xc5000_priv while timer_sleep is still\nactive and attempts to dereference the xc5000_priv.\n\nA typical race condition is illustrated below:\n\nCPU 0 (release thread)                 | CPU 1 (delayed work callback)\nxc5000_release()                       | xc5000_do_timer_sleep()\n  cancel_delayed_work()                |\n  hybrid_tuner_release_state(priv)     |\n    kfree(priv)                        |\n                                       |   priv = container_of() // UAF\n\nReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure\nthat the timer_sleep is properly canceled before the xc5000_priv memory\nis deallocated.\n\nA deadlock concern was considered: xc5000_release() is called in a process\ncontext and is not holding any locks that the timer_sleep work item might\nalso need. Therefore, the use of the _sync() variant is safe here.\n\nThis bug was initially identified through static analysis.\n\n[hverkuil: fix typo in Subject: tunner -\u003e tuner]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Both halves are software-local: the attacker arms the 5-second `timer_sleep` work through the local `/dev/dvb/adapterN/frontend0` or `/dev/videoN` device node, and the freeing `dvb_frontend_detach()` path is entered by a local write to `/sys/bus/pci/devices/\u003cdev\u003e/remove`/`unbind` or `rmmod` on the PCIe xc5000 cards (cx23885, cx88, saa7134), with no network, adjacent-network, or remote-peer data path into `xc5000_release()`.\nAC:L - The attacker fully controls the arming side with deterministic timing \u2014 `dvb_shutdown_timeout` defaults to 0, so closing the frontend immediately triggers `xc5000_sleep()` and the work fires exactly 5 s later \u2014 and the callback then executes for roughly 350 ms on cx231xx boards (`msleep(10)+msleep(330)+msleep(10)` in `cx231xx_tuner_callback()`), an enormous window that can be re-armed indefinitely for free; once it is hit, `cancel_delayed_work()` cannot steal a running work item and the use-after-free is unconditional.\nPR:L - Arming the vulnerable work requires nothing more than opening and closing the DVB frontend or V4L2 video node, which systemd tags with `uaccess` (and which is group `video` on media appliances, set-top boxes and DVR/kiosk systems), so an ordinary unprivileged local account suffices; no capability, user namespace, or root is needed on the attacker-controlled side.\nUI:R - Completing the exploit needs the free itself, which only occurs on driver teardown \u2014 an administrator running `rmmod`/`unbind`, or a user unplugging the USB TV tuner \u2014 an action the unprivileged attacker cannot perform, so a separate user must act while the primed work is executing.\nS:U - The corruption is confined to kernel heap objects (the freed `struct xc5000_priv` and whatever reclaims its kmalloc-192 slot) within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `xc5000_do_timer_sleep()` reads `priv-\u003efe` out of the freed slab and `xc5000_tuner_reset()` then dereferences `fe-\u003edvb`, `fe-\u003edvb-\u003epriv` and `priv-\u003ei2c_props.adap-\u003ealgo_data`, so spraying the kmalloc-192 cache turns the dangling pointer into an arbitrary-address read chain and leaks kernel pointers that defeat KASLR.\nI:H - `xc5000_tuner_reset()` performs `fe-\u003ecallback(...)` where `fe` was loaded from the freed object, giving a fully attacker-controlled indirect call with a controlled first argument once the slab is reclaimed \u2014 a direct control-flow hijack primitive, not merely a stray read.\nA:H - Dereferencing the freed `xc5000_priv` from workqueue context reliably produces a KASAN slab-use-after-free splat and an oops/panic (and the bogus function-pointer call faults in kernel context), taking the system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:59.351Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bc4ffd962ce16a154c44c68853b9d93f5b6fc4b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2f5eaafc0306a76fb1cb760aae804b065b8a341"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f876cd47ed8bca1e28d68435845949f51f90703"
        },
        {
          "url": "https://git.kernel.org/stable/c/df0303b4839520b84d9367c2fad65b13650a4d42"
        },
        {
          "url": "https://git.kernel.org/stable/c/71ed8b81a4906cb785966910f39cf7f5ad60a69e"
        },
        {
          "url": "https://git.kernel.org/stable/c/effb1c19583bca7022fa641a70766de45c6d41ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a00de20ed8ba90888479749b87bc1532cded4ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/4266f012806fc18e46da4a04d130df59a4946f93"
        },
        {
          "url": "https://git.kernel.org/stable/c/40b7a19f321e65789612ebaca966472055dab48c"
        }
      ],
      "title": "media: tuner: xc5000: Fix use-after-free in xc5000_release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39994",
    "datePublished": "2025-10-15T07:58:19.503Z",
    "dateReserved": "2025-04-16T07:20:57.150Z",
    "dateUpdated": "2026-08-05T12:06:59.351Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39994",
      "date": "2026-09-20",
      "epss": "0.00155",
      "percentile": "0.05089"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-16T01:02:44.000Z",
      "cve": "CVE-2025-39994",
      "id": "msrc_CVE-2025-39994",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "media: tuner: xc5000: Fix use-after-free in xc5000_release",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39994.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/tuners/xc5000.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "bc4ffd962ce16a154c44c68853b9d93f5b6fc4b8",
                    "status": "affected",
                    "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e2f5eaafc0306a76fb1cb760aae804b065b8a341",
                    "status": "affected",
                    "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3f876cd47ed8bca1e28d68435845949f51f90703",
                    "status": "affected",
                    "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "df0303b4839520b84d9367c2fad65b13650a4d42",
                    "status": "affected",
                    "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "71ed8b81a4906cb785966910f39cf7f5ad60a69e",
                    "status": "affected",
                    "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "effb1c19583bca7022fa641a70766de45c6d41ac",
                    "status": "affected",
                    "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9a00de20ed8ba90888479749b87bc1532cded4ce",
                    "status": "affected",
                    "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4266f012806fc18e46da4a04d130df59a4946f93",
                    "status": "affected",
                    "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "40b7a19f321e65789612ebaca966472055dab48c",
                    "status": "affected",
                    "version": "f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/tuners/xc5000.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.16"
                  },
                  {
                    "lessThan": "3.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.301",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.246",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.195",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.156",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: tuner: xc5000: Fix use-after-free in xc5000_release\n\nThe original code uses cancel_delayed_work() in xc5000_release(), which\ndoes not guarantee that the delayed work item timer_sleep has fully\ncompleted if it was already running. This leads to use-after-free scenarios\nwhere xc5000_release() may free the xc5000_priv while timer_sleep is still\nactive and attempts to dereference the xc5000_priv.\n\nA typical race condition is illustrated below:\n\nCPU 0 (release thread)                 | CPU 1 (delayed work callback)\nxc5000_release()                       | xc5000_do_timer_sleep()\n  cancel_delayed_work()                |\n  hybrid_tuner_release_state(priv)     |\n    kfree(priv)                        |\n                                       |   priv = container_of() // UAF\n\nReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure\nthat the timer_sleep is properly canceled before the xc5000_priv memory\nis deallocated.\n\nA deadlock concern was considered: xc5000_release() is called in a process\ncontext and is not holding any locks that the timer_sleep work item might\nalso need. Therefore, the use of the _sync() variant is safe here.\n\nThis bug was initially identified through static analysis.\n\n[hverkuil: fix typo in Subject: tunner -\u003e tuner]"
          }
        ],
        "id": "CVE-2025-39994",
        "lastModified": "2026-07-30T06:24:05.577",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.3,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-10-15T08:15:37.567",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3f876cd47ed8bca1e28d68435845949f51f90703"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/40b7a19f321e65789612ebaca966472055dab48c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4266f012806fc18e46da4a04d130df59a4946f93"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/71ed8b81a4906cb785966910f39cf7f5ad60a69e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9a00de20ed8ba90888479749b87bc1532cded4ce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bc4ffd962ce16a154c44c68853b9d93f5b6fc4b8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/df0303b4839520b84d9367c2fad65b13650a4d42"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e2f5eaafc0306a76fb1cb760aae804b065b8a341"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/effb1c19583bca7022fa641a70766de45c6d41ac"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:53:19+00:00",
      "cve": "CVE-2025-39994",
      "id": "CVE-2025-39994",
      "initial_release_date": "2025-10-15T00:00:00+00:00",
      "product_status:known_affected": "48",
      "product_status:known_not_affected": "226",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39994.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:47:38Z",
      "cve": "CVE-2025-39994",
      "id": "CVE-2025-39994",
      "initial_release_date": "2025-10-16T23:24:10Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "327",
      "product_status:recommended": "470",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39994",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39994.json",
      "version": "47"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.