SECUFOCUSNOW
Home›CVE index›CVE-2025-39994
Review reviewHigh

CVE-2025-39994

Linux

In the Linux kernel, the following vulnerability has been resolved: media: tuner: xc5000: Fix use-after-free in xc5000_release The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep has fully completed if it was already running. This leads to use-after-free scenarios where xc5000_release() may free the xc5000_priv while timer_sleep is still active and attempts to dereference the xc5000_priv. A typical race condition is illustrated below: CPU 0 (release thread) | CPU 1 (delayed work callback) xc5000_release() | xc5000...

CVSS
7.3
EPSS
-
- percentile
CISA KEV
Not listed
Published
2025.10.15
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.3

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: media: tuner: xc5000: Fix use-after-free in xc5000_release The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep has fully completed if it was already running. This leads to use-after-free scenarios where xc5000_release() may free the xc5000_priv while timer_sleep is still active and attempts to dereference the xc5000_priv. A typical race condition is illustrated below: CPU 0 (release thread) | CPU 1 (delayed work callback) xc5000_release() | xc5000...

Affected product and versions

Product
Linux
Affected versions
>= f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 < bc4ffd962ce16a154c44c68853b9d93f5b6fc4b8, >= f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 < e2f5eaafc0306a76fb1cb760aae804b065b8a341, >= f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 < 3f876cd47ed8bca1e28d68435845949f51f90703, >= f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 < df0303b4839520b84d9367c2fad65b13650a4d42, >= f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 < 71ed8b81a4906cb785966910f39cf7f5ad60a69e, >= f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 < effb1c19583bca7022fa641a70766de45c6d41ac, >= f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 < 9a00de20ed8ba90888479749b87bc1532cded4ce, >= f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 < 4266f012806fc18e46da4a04d130df59a4946f93, >= f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 < 40b7a19f321e65789612ebaca966472055dab48c, >= 3.16
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE
Not available