CVE-2025-39996
BaseFortify
Publication date: 2025-10-15
Last updated on: 2025-10-29
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| b2c2 | flexcop | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free bug in the Linux kernel's media subsystem related to the b2c2 FlexCop PCI device driver. The issue occurs because the function flexcop_pci_remove() uses cancel_delayed_work() to stop a delayed work item (irq_check_work), but this function does not guarantee that the delayed work has fully completed if it was already running. As a result, the flexcop_device can be freed while irq_check_work is still active and tries to access the freed device, leading to a use-after-free condition. This can cause kernel crashes or undefined behavior. The fix involves replacing cancel_delayed_work() with cancel_delayed_work_sync() to ensure the delayed work is fully canceled and finished before freeing the device memory.
How can this vulnerability impact me? :
This vulnerability can lead to use-after-free conditions in the kernel, which may cause system instability, crashes, or potential escalation of privileges if exploited. Since it involves kernel memory management and device driver operations, it could be leveraged by attackers to execute arbitrary code or cause denial of service on affected systems running the vulnerable driver.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for use-after-free errors related to the flexcop_pci device in the Linux kernel. Specifically, Kernel Address Sanitizer (KASAN) reports indicating slab-use-after-free in the flexcop_pci_remove and irq_check_work functions can reveal the issue. To detect it, you can enable KASAN in your kernel and check dmesg or kernel logs for related BUG reports. There are no specific commands provided for detection in the available information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, replace the use of cancel_delayed_work() with cancel_delayed_work_sync() in the flexcop_pci_remove() function. This ensures that the delayed work item irq_check_work is properly canceled and any executing delayed work has finished before the device memory is deallocated, preventing use-after-free scenarios.