In the Linux kernel, the following vulnerability has been resolved:
ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog
The ptp_ocp_detach() only shuts down the watchdog timer if it is
pending. However, if the timer handler is already running, the
timer_delete_sync() is not called. This leads to race conditions
where the devlink that contains the ptp_ocp is deallocated while
the timer handler is still accessing it, resulting in use-after-free
bugs. The following details one of the race scenarios.
(thread 1) | (thread 2)
ptp_ocp_remove() |
ptp_ocp_detach() | ptp_ocp_watchdog()
if (timer_pending(&bp->watchdog))| bp = timer_container_of()
timer_delete_sync() |
|
devlink_free(devlink) //free |
| bp-> //use
Resolve this by unconditionally calling timer_delete_sync() to ensure
the timer is reliably deactivated, preventing any access after free.
References
Configurations
Configuration 1 (hide)
|
History
12 Dec 2025, 21:21
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* |
|
| First Time |
Linux
Linux linux Kernel |
|
| References | () https://git.kernel.org/stable/c/8bf935cf789872350b04c1a6468b0a509f67afb2 - Patch | |
| References | () https://git.kernel.org/stable/c/f10d3c7267ac7387a5129d5506c3c5f2460cfd9b - Patch | |
| CWE | CWE-416 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
19 Sep 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-19 16:15
Updated : 2025-12-12 21:21
NVD link : CVE-2025-39859
Mitre link : CVE-2025-39859
CVE.ORG link : CVE-2025-39859
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free