CVE-2025-39944
BaseFortify
Publication date: 2025-10-04
Last updated on: 2026-04-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| marvell | octeontx2 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free bug in the Linux kernel's octeontx2-pf driver, specifically in the otx2_sync_tstamp() function. The issue arises because the code uses cancel_delayed_work() to stop a delayed work item, but this function does not guarantee that the work has fully completed if it was already running. As a result, the otx2_ptp structure can be freed while the delayed work is still active and tries to access the freed memory, leading to a use-after-free condition. This is a race condition where one CPU frees the resource while another CPU is still using it. The fix involves replacing cancel_delayed_work() with cancel_delayed_work_sync() to ensure the delayed work is fully canceled before freeing the resource.
How can this vulnerability impact me? :
This vulnerability can lead to use-after-free memory corruption in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges. Because the delayed work is cyclic and the race condition is non-negligible, the bug can be triggered in real-world scenarios, potentially compromising system reliability and security.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for use-after-free bugs related to the otx2_sync_tstamp() function in the Linux kernel, particularly involving the octeontx2-pf driver. Detection may involve checking kernel logs for KASAN (Kernel Address Sanitizer) reports indicating slab-use-after-free errors referencing __run_timer_base and otx2_ptp structures. Specific commands to check kernel logs include: 'dmesg | grep -i kasan' or 'journalctl -k | grep -i kasan'. Additionally, reproducing the issue may require simulating the OcteonTX2 PCI device in QEMU with artificial delays in otx2_sync_tstamp(), but this is more for testing than detection on production systems.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, update the Linux kernel to a version where the fix is applied. The fix involves replacing cancel_delayed_work() with cancel_delayed_work_sync() in the otx2_ptp_destroy() function to ensure the delayed work item synctstamp_work is fully canceled before deallocating otx2_ptp, preventing use-after-free scenarios. If updating is not immediately possible, avoid unloading or removing the octeontx2-pf driver or the affected PCI device until a patch is applied.