---
id: CVE-2025-39859
title: 'ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog

  The ptp_ocp_detach() only shuts down the watchdog timer if it is
  pending. However, if the timer handler i…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 773bda96492153e11d21eb63ac814669b51fc701 <
    e2a6eabe5304a789b7d40ce2576cd80154255e51
  - >-
    Linux >= 773bda96492153e11d21eb63ac814669b51fc701 <
    aad70bdfc8244616e48c434310cab241a3f17781
  - >-
    Linux >= 773bda96492153e11d21eb63ac814669b51fc701 <
    f10d3c7267ac7387a5129d5506c3c5f2460cfd9b
  - >-
    Linux >= 773bda96492153e11d21eb63ac814669b51fc701 <
    8bf935cf789872350b04c1a6468b0a509f67afb2
  - Linux 5.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-01-14T19:22:59.022358Z'
published: '2025-09-19'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:37:29.513Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39859'
references:
  - url: 'https://git.kernel.org/stable/c/e2a6eabe5304a789b7d40ce2576cd80154255e51'
  - url: 'https://git.kernel.org/stable/c/aad70bdfc8244616e48c434310cab241a3f17781'
  - url: 'https://git.kernel.org/stable/c/f10d3c7267ac7387a5129d5506c3c5f2460cfd9b'
  - url: 'https://git.kernel.org/stable/c/8bf935cf789872350b04c1a6468b0a509f67afb2'
tags:
  - cve.org
epss: 0.00195
epssPercentile: 0.09087
ingestedAt: '2026-10-21T12:48:53.687Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog

The ptp_ocp_detach() only shuts down the watchdog timer if it is
pending. However, if the timer handler is already running, the
timer_delete_sync() is not called. This leads to race conditions
where the devlink that contains the ptp_ocp is deallocated while
the timer handler is still accessing it, resulting in use-after-free
bugs. The following details one of the race scenarios.

(thread 1)                           | (thread 2)
ptp_ocp_remove()                     |
  ptp_ocp_detach()                   | ptp_ocp_watchdog()
    if (timer_pending(&bp->watchdog))|   bp = timer_container_of()
      timer_delete_sync()            |
                                     |
  devlink_free(devlink) //free       |
                                     |   bp-> //use

Resolve this by unconditionally calling timer_delete_sync() to ensure
the timer is reliably deactivated, preventing any access after free.

## Affected

- `Linux >= 773bda96492153e11d21eb63ac814669b51fc701 < e2a6eabe5304a789b7d40ce2576cd80154255e51`
- `Linux >= 773bda96492153e11d21eb63ac814669b51fc701 < aad70bdfc8244616e48c434310cab241a3f17781`
- `Linux >= 773bda96492153e11d21eb63ac814669b51fc701 < f10d3c7267ac7387a5129d5506c3c5f2460cfd9b`
- `Linux >= 773bda96492153e11d21eb63ac814669b51fc701 < 8bf935cf789872350b04c1a6468b0a509f67afb2`
- `Linux 5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.