CVE ID : CVE-2025-39996<\/p>\n
Published : Oct. 15, 2025, 8:15 a.m. | 24\u00a0minutes ago<\/p>\n
Description : In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove<\/p>\n
The original code uses cancel_delayed_work() in flexcop_pci_remove(), which
\ndoes not guarantee that the delayed work item irq_check_work has fully
\ncompleted if it was already running. This leads to use-after-free scenarios
\nwhere flexcop_pci_remove() may free the flexcop_device while irq_check_work
\nis still active and attempts to dereference the device.<\/p>\n
A typical race condition is illustrated below:<\/p>\n
CPU 0 (remove) | CPU 1 (delayed work callback)
\nflexcop_pci_remove() | flexcop_pci_irq_check_work()
\n cancel_delayed_work() |
\n flexcop_device_kfree(fc_pci->fc_dev) |
\n | fc = fc_pci->fc_dev; \/\/ UAF<\/p>\n
This is confirmed by a KASAN report:<\/p>\n
==================================================================
\nBUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7\/0x8c0
\nWrite of size 8 at addr ffff8880093aa8c8 by task bash\/135
\n…
\nCall Trace:<\/p>\n
dump_stack_lvl+0x55\/0x70
\n print_report+0xcf\/0x610
\n ? __run_timer_base.part.0+0x7d7\/0x8c0
\n kasan_report+0xb8\/0xf0
\n ? __run_timer_base.part.0+0x7d7\/0x8c0
\n __run_timer_base.part.0+0x7d7\/0x8c0
\n ? __pfx___run_timer_base.part.0+0x10\/0x10
\n ? __pfx_read_tsc+0x10\/0x10
\n ? ktime_get+0x60\/0x140
\n ? lapic_next_event+0x11\/0x20
\n ? clockevents_program_event+0x1d4\/0x2a0
\n run_timer_softirq+0xd1\/0x190
\n handle_softirqs+0x16a\/0x550
\n irq_exit_rcu+0xaf\/0xe0
\n sysvec_apic_timer_interrupt+0x70\/0x80<\/p>\n
…<\/p>\n
Allocated by task 1:
\n kasan_save_stack+0x24\/0x50
\n kasan_save_track+0x14\/0x30
\n __kasan_kmalloc+0x7f\/0x90
\n __kmalloc_noprof+0x1be\/0x460
\n flexcop_device_kmalloc+0x54\/0xe0
\n flexcop_pci_probe+0x1f\/0x9d0
\n local_pci_probe+0xdc\/0x190
\n pci_device_probe+0x2fe\/0x470
\n really_probe+0x1ca\/0x5c0
\n __driver_probe_device+0x248\/0x310
\n driver_probe_device+0x44\/0x120
\n __driver_attach+0xd2\/0x310
\n bus_for_each_dev+0xed\/0x170
\n bus_add_driver+0x208\/0x500
\n driver_register+0x132\/0x460
\n do_one_initcall+0x89\/0x300
\n kernel_init_freeable+0x40d\/0x720
\n kernel_init+0x1a\/0x150
\n ret_from_fork+0x10c\/0x1a0
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
Freed by task 135:
\n kasan_save_stack+0x24\/0x50
\n kasan_save_track+0x14\/0x30
\n kasan_save_free_info+0x3a\/0x60
\n __kasan_slab_free+0x3f\/0x50
\n kfree+0x137\/0x370
\n flexcop_device_kfree+0x32\/0x50
\n pci_device_remove+0xa6\/0x1d0
\n device_release_driver_internal+0xf8\/0x210
\n pci_stop_bus_device+0x105\/0x150
\n pci_stop_and_remove_bus_device_locked+0x15\/0x30
\n remove_store+0xcc\/0xe0
\n kernfs_fop_write_iter+0x2c3\/0x440
\n vfs_write+0x871\/0xd70
\n ksys_write+0xee\/0x1c0
\n do_syscall_64+0xac\/0x280
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f
\n…<\/p>\n
Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
\nthat the delayed work item is properly canceled and any executing delayed
\nwork has finished before the device memory is deallocated.<\/p>\n
This bug was initially identified through static analysis. To reproduce
\nand test it, I simulated the B2C2 FlexCop PCI device in QEMU and introduced
\nartificial delays within the flexcop_pci_irq_check_work() function to
\nincrease the likelihood of triggering the bug.<\/p>\n
Severity: 0.0 | NA<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID : CVE-2025-39996 Published : Oct. 15, 2025, 8:15 a.m. | 24\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove The original code uses cancel_delayed_work() in flexcop_pci_remove(), which does not guarantee that the delayed work item irq_check_work has fully completed …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-71727","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/71727","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=71727"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/71727\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=71727"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=71727"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=71727"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}