CVE ID : CVE-2025-39994<\/p>\n
Published : Oct. 15, 2025, 8:15 a.m. | 24\u00a0minutes ago<\/p>\n
Description : In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: tuner: xc5000: Fix use-after-free in xc5000_release<\/p>\n
The original code uses cancel_delayed_work() in xc5000_release(), which
\ndoes not guarantee that the delayed work item timer_sleep has fully
\ncompleted if it was already running. This leads to use-after-free scenarios
\nwhere xc5000_release() may free the xc5000_priv while timer_sleep is still
\nactive and attempts to dereference the xc5000_priv.<\/p>\n
A typical race condition is illustrated below:<\/p>\n
CPU 0 (release thread) | CPU 1 (delayed work callback)
\nxc5000_release() | xc5000_do_timer_sleep()
\n cancel_delayed_work() |
\n hybrid_tuner_release_state(priv) |
\n kfree(priv) |
\n | priv = container_of() \/\/ UAF<\/p>\n
Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
\nthat the timer_sleep is properly canceled before the xc5000_priv memory
\nis deallocated.<\/p>\n
A deadlock concern was considered: xc5000_release() is called in a process
\ncontext and is not holding any locks that the timer_sleep work item might
\nalso need. Therefore, the use of the _sync() variant is safe here.<\/p>\n
This bug was initially identified through static analysis.<\/p>\n[hverkuil: fix typo in Subject: tunner -> tuner]\n
Severity: 0.0 | NA<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID : CVE-2025-39994 Published : Oct. 15, 2025, 8:15 a.m. | 24\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: media: tuner: xc5000: Fix use-after-free in xc5000_release The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep has fully completed if it …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-71729","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/71729","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=71729"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/71729\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=71729"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=71729"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=71729"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}