CVE ID : CVE-2025-39993<\/p>\n
Published : Oct. 15, 2025, 8:15 a.m. | 24\u00a0minutes ago<\/p>\n
Description : In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: rc: fix races with imon_disconnect()<\/p>\n
Syzbot reports a KASAN issue as below:
\nBUG: KASAN: use-after-free in __create_pipe include\/linux\/usb.h:1945 [inline]\nBUG: KASAN: use-after-free in send_packet+0xa2d\/0xbc0 drivers\/media\/rc\/imon.c:627
\nRead of size 4 at addr ffff8880256fb000 by task syz-executor314\/4465<\/p>\n
CPU: 2 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0
\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04\/01\/2014
\nCall Trace:<\/p>\n
__dump_stack lib\/dump_stack.c:88 [inline]\ndump_stack_lvl+0xcd\/0x134 lib\/dump_stack.c:106
\nprint_address_description mm\/kasan\/report.c:317 [inline]\nprint_report.cold+0x2ba\/0x6e9 mm\/kasan\/report.c:433
\nkasan_report+0xb1\/0x1e0 mm\/kasan\/report.c:495
\n__create_pipe include\/linux\/usb.h:1945 [inline]\nsend_packet+0xa2d\/0xbc0 drivers\/media\/rc\/imon.c:627
\nvfd_write+0x2d9\/0x550 drivers\/media\/rc\/imon.c:991
\nvfs_write+0x2d7\/0xdd0 fs\/read_write.c:576
\nksys_write+0x127\/0x250 fs\/read_write.c:631
\ndo_syscall_x64 arch\/x86\/entry\/common.c:50 [inline]\ndo_syscall_64+0x35\/0xb0 arch\/x86\/entry\/common.c:80
\nentry_SYSCALL_64_after_hwframe+0x63\/0xcd<\/p>\n
The iMON driver improperly releases the usb_device reference in
\nimon_disconnect without coordinating with active users of the
\ndevice.<\/p>\n
Specifically, the fields usbdev_intf0 and usbdev_intf1 are not
\nprotected by the users counter (ictx->users). During probe,
\nimon_init_intf0 or imon_init_intf1 increments the usb_device
\nreference count depending on the interface. However, during
\ndisconnect, usb_put_dev is called unconditionally, regardless of
\nactual usage.<\/p>\n
As a result, if vfd_write or other operations are still in
\nprogress after disconnect, this can lead to a use-after-free of
\nthe usb_device pointer.<\/p>\n
Thread 1 vfd_write Thread 2 imon_disconnect
\n …
\n if
\n usb_put_dev(ictx->usbdev_intf0)
\n else
\n usb_put_dev(ictx->usbdev_intf1)
\n…
\nwhile
\n send_packet
\n if
\n pipe = usb_sndintpipe(
\n ictx->usbdev_intf0) UAF
\n else
\n pipe = usb_sndctrlpipe(
\n ictx->usbdev_intf0, 0) UAF<\/p>\n
Guard access to usbdev_intf0 and usbdev_intf1 after disconnect by
\nchecking ictx->disconnected in all writer paths. Add early return
\nwith -ENODEV in send_packet(), vfd_write(), lcd_write() and
\ndisplay_open() if the device is no longer present.<\/p>\n
Set and read ictx->disconnected under ictx->lock to ensure memory
\nsynchronization. Acquire the lock in imon_disconnect() before setting
\nthe flag to synchronize with any ongoing operations.<\/p>\n
Ensure writers exit early and safely after disconnect before the USB
\ncore proceeds with cleanup.<\/p>\n
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.<\/p>\n
Severity: 0.0 | NA<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID : CVE-2025-39993 Published : Oct. 15, 2025, 8:15 a.m. | 24\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include\/linux\/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d\/0xbc0 drivers\/media\/rc\/imon.c:627 Read of size …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-71730","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/71730","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=71730"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/71730\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=71730"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=71730"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=71730"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}