CVE-2025-40003
BaseFortify
Publication date: 2025-10-18
Last updated on: 2025-10-21
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mscc | ocelot | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free (UAF) issue in the Linux kernel's mscc ocelot network driver. It occurs because a delayed work item (ocelot->stats_work) can be rescheduled after the workqueue has been destroyed. The function cancel_delayed_work() used to cancel this work item may fail if the work is already executing, and destroy_workqueue() cannot prevent the delayed work from being re-queued after its timer expires. This leads to the workqueue being destroyed while the delayed work item is still scheduled, causing a use-after-free condition and kernel warnings. The fix replaces cancel_delayed_work() with disable_delayed_work_sync(), which ensures the delayed work is properly cancelled and completed before the workqueue is destroyed, preventing the UAF.
How can this vulnerability impact me? :
This vulnerability can cause kernel instability or crashes due to use-after-free errors in the network driver. It may lead to warnings and potential system faults when the delayed work item is rescheduled after the workqueue is destroyed. Such instability can affect system reliability and availability, especially on systems using the affected mscc ocelot driver.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for warnings related to workqueue issues, specifically messages like "workqueue: cannot queue ocelot_check_stats_work on wq ocelot-switch-stats". Checking dmesg or system logs for such warnings can help identify the presence of the issue. Example command: `dmesg | grep ocelot_check_stats_work` or `journalctl -k | grep ocelot_check_stats_work`.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the fix is applied. The fix replaces cancel_delayed_work() with disable_delayed_work_sync() in the ocelot_stats_deinit() function to ensure proper cancellation and completion of delayed work items before destroying the workqueue, preventing use-after-free. Until an update is applied, avoid triggering the ocelot_stats_deinit() path or the affected workqueue operations if possible.