CVE ID : CVE-2025-40003<\/p>\n
Published : Oct. 18, 2025, 8:15 a.m. | 25\u00a0minutes ago<\/p>\n
Description : In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work<\/p>\n
The origin code calls cancel_delayed_work() in ocelot_stats_deinit()
\nto cancel the cyclic delayed work item ocelot->stats_work. However,
\ncancel_delayed_work() may fail to cancel the work item if it is already
\nexecuting. While destroy_workqueue() does wait for all pending work items
\nin the work queue to complete before destroying the work queue, it cannot
\nprevent the delayed work item from being rescheduled within the
\nocelot_check_stats_work() function. This limitation exists because the
\ndelayed work item is only enqueued into the work queue after its timer
\nexpires. Before the timer expiration, destroy_workqueue() has no visibility
\nof this pending work item. Once the work queue appears empty,
\ndestroy_workqueue() proceeds with destruction. When the timer eventually
\nexpires, the delayed work item gets queued again, leading to the following
\nwarning:<\/p>\n
workqueue: cannot queue ocelot_check_stats_work on wq ocelot-switch-stats
\nWARNING: CPU: 2 PID: 0 at kernel\/workqueue.c:2255 __queue_work+0x875\/0xaf0
\n…
\nRIP: 0010:__queue_work+0x875\/0xaf0
\n…
\nRSP: 0018:ffff88806d108b10 EFLAGS: 00010086
\nRAX: 0000000000000000 RBX: 0000000000000101 RCX: 0000000000000027
\nRDX: 0000000000000027 RSI: 0000000000000004 RDI: ffff88806d123e88
\nRBP: ffffffff813c3170 R08: 0000000000000000 R09: ffffed100da247d2
\nR10: ffffed100da247d1 R11: ffff88806d123e8b R12: ffff88800c00f000
\nR13: ffff88800d7285c0 R14: ffff88806d0a5580 R15: ffff88800d7285a0
\nFS: 0000000000000000(0000) GS:ffff8880e5725000(0000) knlGS:0000000000000000
\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
\nCR2: 00007fe18e45ea10 CR3: 0000000005e6c000 CR4: 00000000000006f0
\nCall Trace:<\/p>\n
? kasan_report+0xc6\/0xf0
\n ? __pfx_delayed_work_timer_fn+0x10\/0x10
\n ? __pfx_delayed_work_timer_fn+0x10\/0x10
\n call_timer_fn+0x25\/0x1c0
\n __run_timer_base.part.0+0x3be\/0x8c0
\n ? __pfx_delayed_work_timer_fn+0x10\/0x10
\n ? rcu_sched_clock_irq+0xb06\/0x27d0
\n ? __pfx___run_timer_base.part.0+0x10\/0x10
\n ? try_to_wake_up+0xb15\/0x1960
\n ? _raw_spin_lock_irq+0x80\/0xe0
\n ? __pfx__raw_spin_lock_irq+0x10\/0x10
\n tmigr_handle_remote_up+0x603\/0x7e0
\n ? __pfx_tmigr_handle_remote_up+0x10\/0x10
\n ? sched_balance_trigger+0x1c0\/0x9f0
\n ? sched_tick+0x221\/0x5a0
\n ? _raw_spin_lock_irq+0x80\/0xe0
\n ? __pfx__raw_spin_lock_irq+0x10\/0x10
\n ? tick_nohz_handler+0x339\/0x440
\n ? __pfx_tmigr_handle_remote_up+0x10\/0x10
\n __walk_groups.isra.0+0x42\/0x150
\n tmigr_handle_remote+0x1f4\/0x2e0
\n ? __pfx_tmigr_handle_remote+0x10\/0x10
\n ? ktime_get+0x60\/0x140
\n ? lapic_next_event+0x11\/0x20
\n ? clockevents_program_event+0x1d4\/0x2a0
\n ? hrtimer_interrupt+0x322\/0x780
\n handle_softirqs+0x16a\/0x550
\n irq_exit_rcu+0xaf\/0xe0
\n sysvec_apic_timer_interrupt+0x70\/0x80<\/p>\n
…<\/p>\n
The following diagram reveals the cause of the above warning:<\/p>\n
CPU 0 (remove) | CPU 1 (delayed work callback)
\nmscc_ocelot_remove() |
\n ocelot_deinit() | ocelot_check_stats_work()
\n ocelot_stats_deinit() |
\n cancel_delayed_work()| …
\n | queue_delayed_work()
\n destroy_workqueue() | (wait a time)
\n | __queue_work() \/\/UAF<\/p>\n
The above scenario actually constitutes a UAF vulnerability.<\/p>\n
The ocelot_stats_deinit() is only invoked when initialization
\nfailure or resource destruction, so we must ensure that any
\ndelayed work items cannot be rescheduled.<\/p>\n
Replace cancel_delayed_work() with disable_delayed_work_sync()
\nto guarantee proper cancellation of the delayed work item and
\nensure completion of any currently executing work before the
\nworkqueue is deallocated.<\/p>\n
A deadlock concern was considered: ocelot_stats_deinit() is called
\nin a process context and is not holding any locks that the delayed
\nwork item might also need. Therefore, the use of the _sync() variant
\nis safe here.<\/p>\n
This bug was identified through static analysis. To reproduce the
\nissue and validate the fix, I simulated ocelot-swit
\n—truncated—<\/p>\n
Severity: 0.0 | NA<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID : CVE-2025-40003 Published : Oct. 18, 2025, 8:15 a.m. | 25\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work The origin code calls cancel_delayed_work() in ocelot_stats_deinit() to cancel the cyclic delayed work item ocelot->stats_work. However, cancel_delayed_work() may fail …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-71949","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/71949","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=71949"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/71949\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=71949"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=71949"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=71949"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}