CVE-2025-39774: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-39774 is a race condition vulnerability in the Linux kernel's IIO ADC driver for RZ/G2L platforms (iio: adc: rzg2l_adc) that can cause a system crash when driver data (drvdata) is not set before runtime PM is enabled. The flaw affects Linux kernel versions from 6.14 up to (but not including) 6.16.4, as well as release candidates 6.17-rc1 and 6.17-rc2. It was published on September 11, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a race condition (CWE-362) in the rzg2l_adc driver's probe sequence: runtime PM is enabled before drvdata is assigned via platform_set_drvdata(). When the ADC device acts as a power supplier for a consumer device (e.g., a thermal hardware block), the consumer can trigger a runtime resume of the ADC immediately after PM is enabled but before drvdata is populated. The driver's runtime PM callbacks dereference drvdata, leading to a NULL pointer dereference and kernel crash. The fix moves the platform_set_drvdata() call to immediately after allocation, before any PM enablement (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation results in a kernel crash, causing a denial of service (system unavailability). The vulnerability has no impact on confidentiality or integrity — only availability is affected. It is most relevant to embedded systems using Renesas RZ/G2L SoCs where the ADC is configured as a supplier for other subsystems such as thermal monitoring (Feedly).

No public proof-of-concept exploit exists, and there is no evidence of in-the-wild exploitation. The vulnerability requires low-privilege local access and is triggered by repeatedly unbinding and binding the ADC device under specific hardware configurations (ADC as a PM supplier). The EPSS score is approximately 0.018% (0.000180), indicating very low likelihood of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

The Linux kernel maintainers have released patches addressing this issue in kernel version 6.16.4 and the 6.17-rc3 release candidate. Two upstream commits address the flaw: c69e13965f26b8058f538ea8bdbd2d7718cf1fbe and e7ce902db071a7b3e696a43d6e14ca57360deee6. Users should update to Linux kernel 6.16.4 or later. As a temporary workaround, avoid repeatedly unbinding and binding the ADC device on affected RZ/G2L platforms, and restrict local user access to device management interfaces (Feedly, Kernel Patch 1, Kernel Patch 2).