CVE-2025-39712: media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
Vulnerability summary
CVE-2025-39712 is a medium (CVSS 5.5) Improper Locking vulnerability in linux. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.5% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 22 · Related 21Timeline
- 05-09-2025PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval Getting / Setting the frame interval using the V4L2 subdev pad ops get_frame_interval/set_frame_interval causes a deadlock, as the subdev state is locked in the [1] but also in the driver itself. In [2] it's described that the caller is responsible to acquire and release the lock in this case. Therefore, acquiring the lock in the driver is wrong. Remove the lock acquisitions/releases from mt9m114_ifp_get_frame_interval() and mt9m114_ifp_set_frame_interval(). [1] drivers/media/v4l2-core/v4l2-subdev.c - line 1129 [2] Documentation/driver-api/media/v4l2-subdev.rst
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.11%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.11% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu122 products
- linux< 6.8.0-100.100
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 6.8.0-1046.49
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 24d756e914fc3418bad7897b0657aefa9ef848e8, < 0d23b548d71e5d76955fdf1d73addd8f6494f602 | ≥ 24d756e914fc3418bad7897b0657aefa9ef848e8, < 41b97490a1656bdc7038d6345a84b08d45deafc6 | ≥ 24d756e914fc3418bad7897b0657aefa9ef848e8, < 298d1471cf83d5a2a05970e41822a2403f451086 | 6.7
- linux_kernel≥ 6.7, < 6.12.44 | ≥ 6.13, < 6.16.4
Debian1 product
- linux< 6.12.48-1 | < 6.16.5-1
3 vendors · 125 products
