{"id":"CVE-2025-39944","title":"octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()\n\nThe original code relies on cancel_delayed_work() in otx2_ptp_destroy(),\nwhich does not ensure that the del…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 2958d17a898416c6193431676f6130b68a2cb9fc < 2786879aebf363806a13d41e8d5f99202ddd23d9","Linux >= 2958d17a898416c6193431676f6130b68a2cb9fc < d2cfefa14ce8137b17f99683f968bebf134b6a48","Linux >= 2958d17a898416c6193431676f6130b68a2cb9fc < ff27e23b311fed4d25e3852e27ba693416d4c7b3","Linux >= 2958d17a898416c6193431676f6130b68a2cb9fc < 5ca20bb7b4bde72110c3ae78423cbfdd0157aa36","Linux >= 2958d17a898416c6193431676f6130b68a2cb9fc < f8b4687151021db61841af983f1cb7be6915d4ef","Linux 6.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:54:57.678441Z"},"published":"2025-10-04","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:02:33.699Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39944","references":[{"url":"https://git.kernel.org/stable/c/2786879aebf363806a13d41e8d5f99202ddd23d9"},{"url":"https://git.kernel.org/stable/c/d2cfefa14ce8137b17f99683f968bebf134b6a48"},{"url":"https://git.kernel.org/stable/c/ff27e23b311fed4d25e3852e27ba693416d4c7b3"},{"url":"https://git.kernel.org/stable/c/5ca20bb7b4bde72110c3ae78423cbfdd0157aa36"},{"url":"https://git.kernel.org/stable/c/f8b4687151021db61841af983f1cb7be6915d4ef"}],"tags":["cve.org"],"epss":0.00153,"epssPercentile":0.04387,"ingestedAt":"2026-10-15T22:48:25.530Z","slug":"CVE-2025-39944","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()\n\nThe original code relies on cancel_delayed_work() in otx2_ptp_destroy(),\nwhich does not ensure that the delayed work item synctstamp_work has fully\ncompleted if it was already running. This leads to use-after-free scenarios\nwhere otx2_ptp is deallocated by otx2_ptp_destroy(), while synctstamp_work\nremains active and attempts to dereference otx2_ptp in otx2_sync_tstamp().\nFurthermore, the synctstamp_work is cyclic, the likelihood of triggering\nthe bug is nonnegligible.\n\nA typical race condition is illustrated below:\n\nCPU 0 (cleanup)           | CPU 1 (delayed work callback)\notx2_remove()             |\n  otx2_ptp_destroy()      | otx2_sync_tstamp()\n    cancel_delayed_work() |\n    kfree(ptp)            |\n                          |   ptp = container_of(...); //UAF\n                          |   ptp-> //UAF\n\nThis is confirmed by a KASAN report:\n\nBUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0\nWrite of size 8 at addr ffff88800aa09a18 by task bash/136\n...\nCall Trace:\n <IRQ>\n dump_stack_lvl+0x55/0x70\n print_report+0xcf/0x610\n ? __run_timer_base.part.0+0x7d7/0x8c0\n kasan_report+0xb8/0xf0\n ? __run_timer_base.part.0+0x7d7/0x8c0\n __run_timer_base.part.0+0x7d7/0x8c0\n ? __pfx___run_timer_base.part.0+0x10/0x10\n ? __pfx_read_tsc+0x10/0x10\n ? ktime_get+0x60/0x140\n ? lapic_next_event+0x11/0x20\n ? clockevents_program_event+0x1d4/0x2a0\n run_timer_softirq+0xd1/0x190\n handle_softirqs+0x16a/0x550\n irq_exit_rcu+0xaf/0xe0\n sysvec_apic_timer_interrupt+0x70/0x80\n </IRQ>\n...\nAllocated by task 1:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x7f/0x90\n otx2_ptp_init+0xb1/0x860\n otx2_probe+0x4eb/0xc30\n local_pci_probe+0xdc/0x190\n pci_device_probe+0x2fe/0x470\n really_probe+0x1ca/0x5c0\n __driver_probe_device+0x248/0x310\n driver_probe_device+0x44/0x120\n __driver_attach+0xd2/0x310\n bus_for_each_dev+0xed/0x170\n bus_add_driver+0x208/0x500\n driver_register+0x132/0x460\n do_one_initcall+0x89/0x300\n kernel_init_freeable+0x40d/0x720\n kernel_init+0x1a/0x150\n ret_from_fork+0x10c/0x1a0\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 136:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3a/0x60\n __kasan_slab_free+0x3f/0x50\n kfree+0x137/0x370\n otx2_ptp_destroy+0x38/0x80\n otx2_remove+0x10d/0x4c0\n pci_device_remove+0xa6/0x1d0\n device_release_driver_internal+0xf8/0x210\n pci_stop_bus_device+0x105/0x150\n pci_stop_and_remove_bus_device_locked+0x15/0x30\n remove_store+0xcc/0xe0\n kernfs_fop_write_iter+0x2c3/0x440\n vfs_write+0x871/0xd70\n ksys_write+0xee/0x1c0\n do_syscall_64+0xac/0x280\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n\nReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure\nthat the delayed work item is properly canceled before the otx2_ptp is\ndeallocated.\n\nThis bug was initially identified through static analysis. To reproduce\nand test it, I simulated the OcteonTX2 PCI device in QEMU and introduced\nartificial delays within the otx2_sync_tstamp() function to increase the\nlikelihood of triggering the bug.\n\n## Affected\n\n- `Linux >= 2958d17a898416c6193431676f6130b68a2cb9fc < 2786879aebf363806a13d41e8d5f99202ddd23d9`\n- `Linux >= 2958d17a898416c6193431676f6130b68a2cb9fc < d2cfefa14ce8137b17f99683f968bebf134b6a48`\n- `Linux >= 2958d17a898416c6193431676f6130b68a2cb9fc < ff27e23b311fed4d25e3852e27ba693416d4c7b3`\n- `Linux >= 2958d17a898416c6193431676f6130b68a2cb9fc < 5ca20bb7b4bde72110c3ae78423cbfdd0157aa36`\n- `Linux >= 2958d17a898416c6193431676f6130b68a2cb9fc < f8b4687151021db61841af983f1cb7be6915d4ef`\n- `Linux 6.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}