CVE-2025-39833
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-12-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 2.6.29 (inc) to 6.16.5 (exc) |
| linux | linux_kernel | 6.17 |
| linux | linux_kernel | 6.17 |
| linux | linux_kernel | 6.17 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-908 | The product uses or accesses a resource that has not been initialized. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is related to the Linux kernel's mISDN hfcpci module. When unloading the hfcpci module with CONFIG_DEBUG_OBJECTS_TIMERS enabled, a warning occurs due to deleting an uninitialized timer. This leads to a kernel warning and potential instability. The issue is caused by the timer not being properly initialized before deletion. The fix involves initializing the timer with the DEFINE_TIMER macro and using mod_timer instead of manually updating the timeout.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the system logs for the specific warning messages related to the hfcpci module and timer deletion issues. Look for kernel log entries containing 'ODEBUG: assert_init not available' and warnings from 'debug_print_object' related to the hfcpci module. You can use the following command to search the kernel logs: sudo dmesg | grep -E 'ODEBUG|hfcpci|debug_print_object'. Additionally, monitoring for splat or warning messages when unloading the hfcpci module (e.g., using rmmod) can indicate the presence of this issue.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, update the Linux kernel to a version where the hfcpci module timer initialization is fixed by using the DEFINE_TIMER macro and mod_timer instead of manual timeout updates. If updating is not immediately possible, avoid unloading the hfcpci module when CONFIG_DEBUG_OBJECTS_TIMERS is enabled to prevent the warning and potential instability.
How can this vulnerability impact me? :
This vulnerability can cause kernel warnings and instability when unloading the hfcpci module, potentially leading to system crashes or unexpected behavior. It affects system reliability but does not directly indicate a security breach or data compromise.