SECUFOCUSNOW
Home›CVE index›CVE-2025-39944
Review reviewHigh

CVE-2025-39944

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() The original code relies on cancel_delayed_work() in otx2_ptp_destroy(), which does not ensure that the delayed work item synctstamp_work has fully completed if it was already running. This leads to use-after-free scenarios where otx2_ptp is deallocated by otx2_ptp_destroy(), while synctstamp_work remains active and attempts to dereference otx2_ptp in otx2_sync_tstamp(). Furthermore, the synctstamp_work is cyclic, the likelihood of triggering the bug is nonnegligib...

CVSS
7.8
EPSS
0.14%
3.76% percentile
CISA KEV
Not listed
Published
2025.10.04
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.14%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() The original code relies on cancel_delayed_work() in otx2_ptp_destroy(), which does not ensure that the delayed work item synctstamp_work has fully completed if it was already running. This leads to use-after-free scenarios where otx2_ptp is deallocated by otx2_ptp_destroy(), while synctstamp_work remains active and attempts to dereference otx2_ptp in otx2_sync_tstamp(). Furthermore, the synctstamp_work is cyclic, the likelihood of triggering the bug is nonnegligib...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 2958d17a898416c6193431676f6130b68a2cb9fc < 2786879aebf363806a13d41e8d5f99202ddd23d9, >= 2958d17a898416c6193431676f6130b68a2cb9fc < d2cfefa14ce8137b17f99683f968bebf134b6a48, >= 2958d17a898416c6193431676f6130b68a2cb9fc < ff27e23b311fed4d25e3852e27ba693416d4c7b3, >= 2958d17a898416c6193431676f6130b68a2cb9fc < 5ca20bb7b4bde72110c3ae78423cbfdd0157aa36, >= 2958d17a898416c6193431676f6130b68a2cb9fc < f8b4687151021db61841af983f1cb7be6915d4ef, >= 6.1, >= 6.1 < 6.1.154, >= 6.2 < 6.6.108, >= 6.7 < 6.12.49, >= 6.13 < 6.16.9, 6.17
Fixed versions
6.1.154, 6.6.108, 6.12.49, 6.16.9

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416
CVE-2025-39944 — Linux Linux, linux kernel | SECUFOCUS NOW