CVE ID : CVE-2025-39995<\/p>\n
Published : Oct. 15, 2025, 8:15 a.m. | 24\u00a0minutes ago<\/p>\n
Description : In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe<\/p>\n
The state->timer is a cyclic timer that schedules work_i2c_poll and
\ndelayed_work_enable_hotplug, while rearming itself. Using timer_delete()
\nfails to guarantee the timer isn’t still running when destroyed, similarly
\ncancel_delayed_work() cannot ensure delayed_work_enable_hotplug has
\nterminated if already executing. During probe failure after timer
\ninitialization, these may continue running as orphans and reference the
\nalready-freed tc358743_state object through tc358743_irq_poll_timer.<\/p>\n
The following is the trace captured by KASAN.<\/p>\n
BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7\/0x8c0
\nWrite of size 8 at addr ffff88800ded83c8 by task swapper\/1\/0
\n…
\nCall Trace:<\/p>\n
dump_stack_lvl+0x55\/0x70
\n print_report+0xcf\/0x610
\n ? __pfx_sched_balance_find_src_group+0x10\/0x10
\n ? __run_timer_base.part.0+0x7d7\/0x8c0
\n kasan_report+0xb8\/0xf0
\n ? __run_timer_base.part.0+0x7d7\/0x8c0
\n __run_timer_base.part.0+0x7d7\/0x8c0
\n ? rcu_sched_clock_irq+0xb06\/0x27d0
\n ? __pfx___run_timer_base.part.0+0x10\/0x10
\n ? try_to_wake_up+0xb15\/0x1960
\n ? tmigr_update_events+0x280\/0x740
\n ? _raw_spin_lock_irq+0x80\/0xe0
\n ? __pfx__raw_spin_lock_irq+0x10\/0x10
\n tmigr_handle_remote_up+0x603\/0x7e0
\n ? __pfx_tmigr_handle_remote_up+0x10\/0x10
\n ? sched_balance_trigger+0x98\/0x9f0
\n ? sched_tick+0x221\/0x5a0
\n ? _raw_spin_lock_irq+0x80\/0xe0
\n ? __pfx__raw_spin_lock_irq+0x10\/0x10
\n ? tick_nohz_handler+0x339\/0x440
\n ? __pfx_tmigr_handle_remote_up+0x10\/0x10
\n __walk_groups.isra.0+0x42\/0x150
\n tmigr_handle_remote+0x1f4\/0x2e0
\n ? __pfx_tmigr_handle_remote+0x10\/0x10
\n ? ktime_get+0x60\/0x140
\n ? lapic_next_event+0x11\/0x20
\n ? clockevents_program_event+0x1d4\/0x2a0
\n ? hrtimer_interrupt+0x322\/0x780
\n handle_softirqs+0x16a\/0x550
\n irq_exit_rcu+0xaf\/0xe0
\n sysvec_apic_timer_interrupt+0x70\/0x80<\/p>\n
…<\/p>\n
Allocated by task 141:
\n kasan_save_stack+0x24\/0x50
\n kasan_save_track+0x14\/0x30
\n __kasan_kmalloc+0x7f\/0x90
\n __kmalloc_node_track_caller_noprof+0x198\/0x430
\n devm_kmalloc+0x7b\/0x1e0
\n tc358743_probe+0xb7\/0x610 i2c_device_probe+0x51d\/0x880
\n really_probe+0x1ca\/0x5c0
\n __driver_probe_device+0x248\/0x310
\n driver_probe_device+0x44\/0x120
\n __device_attach_driver+0x174\/0x220
\n bus_for_each_drv+0x100\/0x190
\n __device_attach+0x206\/0x370
\n bus_probe_device+0x123\/0x170
\n device_add+0xd25\/0x1470
\n i2c_new_client_device+0x7a0\/0xcd0
\n do_one_initcall+0x89\/0x300
\n do_init_module+0x29d\/0x7f0
\n load_module+0x4f48\/0x69e0
\n init_module_from_file+0xe4\/0x150
\n idempotent_init_module+0x320\/0x670
\n __x64_sys_finit_module+0xbd\/0x120
\n do_syscall_64+0xac\/0x280
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n
Freed by task 141:
\n kasan_save_stack+0x24\/0x50
\n kasan_save_track+0x14\/0x30
\n kasan_save_free_info+0x3a\/0x60
\n __kasan_slab_free+0x3f\/0x50
\n kfree+0x137\/0x370
\n release_nodes+0xa4\/0x100
\n devres_release_group+0x1b2\/0x380
\n i2c_device_probe+0x694\/0x880
\n really_probe+0x1ca\/0x5c0
\n __driver_probe_device+0x248\/0x310
\n driver_probe_device+0x44\/0x120
\n __device_attach_driver+0x174\/0x220
\n bus_for_each_drv+0x100\/0x190
\n __device_attach+0x206\/0x370
\n bus_probe_device+0x123\/0x170
\n device_add+0xd25\/0x1470
\n i2c_new_client_device+0x7a0\/0xcd0
\n do_one_initcall+0x89\/0x300
\n do_init_module+0x29d\/0x7f0
\n load_module+0x4f48\/0x69e0
\n init_module_from_file+0xe4\/0x150
\n idempotent_init_module+0x320\/0x670
\n __x64_sys_finit_module+0xbd\/0x120
\n do_syscall_64+0xac\/0x280
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f
\n…<\/p>\n
Replace timer_delete() with timer_delete_sync() and cancel_delayed_work()
\nwith cancel_delayed_work_sync() to ensure proper termination of timer and
\nwork items before resource cleanup.<\/p>\n
This bug was initially identified through static analysis. For reproduction
\nand testing, I created a functional emulation of the tc358743 device via a
\nkernel module and introduced faults through the debugfs interface.<\/p>\n
Severity: 0.0 | NA<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID : CVE-2025-39995 Published : Oct. 15, 2025, 8:15 a.m. | 24\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe The state->timer is a cyclic timer that schedules work_i2c_poll and delayed_work_enable_hotplug, while rearming itself. Using timer_delete() fails …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-71728","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/71728","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=71728"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/71728\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=71728"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=71728"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=71728"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}