---
id: CVE-2025-39713
title: 'media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()

  In the interrupt handler rain_interrupt(), the buffer full check on
  rain->buf_len is performed bef…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac <
    2964dbe631fd21ad7873b1752b895548d3c12496
  - >-
    Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac <
    6aaef1a75985865d8c6c5b65fb54152060faba48
  - >-
    Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac <
    fbc81e78d75bf28972bc22b1599559557b1a1b83
  - >-
    Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac <
    3c3e33b7edca7a2d6a96801f287f9faeb684d655
  - >-
    Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac <
    1c2769dc80255824542ea5a4ff1a07dcdeb1603f
  - >-
    Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac <
    ed905fe7cba03cf22ae0b84cf1b73cd1c070423a
  - >-
    Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac <
    ff9dd3db6cd4c6b54a2ecbc58151bea4ec63bc59
  - >-
    Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac <
    7af160aea26c7dc9e6734d19306128cce156ec40
  - Linux 4.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:08:41.457511Z'
published: '2025-09-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:12:55.445Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39713'
references:
  - url: 'https://git.kernel.org/stable/c/2964dbe631fd21ad7873b1752b895548d3c12496'
  - url: 'https://git.kernel.org/stable/c/6aaef1a75985865d8c6c5b65fb54152060faba48'
  - url: 'https://git.kernel.org/stable/c/fbc81e78d75bf28972bc22b1599559557b1a1b83'
  - url: 'https://git.kernel.org/stable/c/3c3e33b7edca7a2d6a96801f287f9faeb684d655'
  - url: 'https://git.kernel.org/stable/c/1c2769dc80255824542ea5a4ff1a07dcdeb1603f'
  - url: 'https://git.kernel.org/stable/c/ed905fe7cba03cf22ae0b84cf1b73cd1c070423a'
  - url: 'https://git.kernel.org/stable/c/ff9dd3db6cd4c6b54a2ecbc58151bea4ec63bc59'
  - url: 'https://git.kernel.org/stable/c/7af160aea26c7dc9e6734d19306128cce156ec40'
tags:
  - cve.org
epss: 0.00144
epssPercentile: 0.03717
ingestedAt: '2026-11-05T22:38:32.019Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()

In the interrupt handler rain_interrupt(), the buffer full check on
rain->buf_len is performed before acquiring rain->buf_lock. This
creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as
rain->buf_len is concurrently accessed and modified in the work
handler rain_irq_work_handler() under the same lock.

Multiple interrupt invocations can race, with each reading buf_len
before it becomes full and then proceeding. This can lead to both
interrupts attempting to write to the buffer, incrementing buf_len
beyond its capacity (DATA_SIZE) and causing a buffer overflow.

Fix this bug by moving the spin_lock() to before the buffer full
check. This ensures that the check and the subsequent buffer modification
are performed atomically, preventing the race condition. An corresponding
spin_unlock() is added to the overflow path to correctly release the
lock.

This possible bug was found by an experimental static analysis tool
developed by our team.

## Affected

- `Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac < 2964dbe631fd21ad7873b1752b895548d3c12496`
- `Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac < 6aaef1a75985865d8c6c5b65fb54152060faba48`
- `Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac < fbc81e78d75bf28972bc22b1599559557b1a1b83`
- `Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac < 3c3e33b7edca7a2d6a96801f287f9faeb684d655`
- `Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac < 1c2769dc80255824542ea5a4ff1a07dcdeb1603f`
- `Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac < ed905fe7cba03cf22ae0b84cf1b73cd1c070423a`
- `Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac < ff9dd3db6cd4c6b54a2ecbc58151bea4ec63bc59`
- `Linux >= 0f314f6c2e77beb1a232be21dd6be4e1849ba5ac < 7af160aea26c7dc9e6734d19306128cce156ec40`
- `Linux 4.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.