In the Linux kernel, the following vulnerability has been resolved:
media: tuner: xc5000: Fix use-after-free in xc5000_release
The original code uses cancel_delayed_work() in xc5000_release(), which
does not guarantee that the delayed work item timer_sleep has fully
completed if it was already running. This leads to use-after-free scenarios
where xc5000_release() may free the xc5000_priv while timer_sleep is still
active and attempts to dereference the xc5000_priv.
A typical race condition is illustrated below:
CPU 0 (release thread) | CPU 1 (delayed work callback)
xc5000_release() | xc5000_do_timer_sleep()
cancel_delayed_work() |
hybrid_tuner_release_state(priv) |
kfree(priv) |
| priv = container_of() // UAF
Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
that the timer_sleep is properly canceled before the xc5000_priv memory
is deallocated.
A deadlock concern was considered: xc5000_release() is called in a process
context and is not holding any locks that the timer_sleep work item might
also need. Therefore, the use of the _sync() variant is safe here.
This bug was initially identified through static analysis.
[hverkuil: fix typo in Subject: tunner -> tuner]
CVSS
No CVSS.
References
Configurations
No configuration.
History
29 Oct 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
19 Oct 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Oct 2025, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Oct 2025, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-15 08:15
Updated : 2025-10-29 14:15
NVD link : CVE-2025-39994
Mitre link : CVE-2025-39994
CVE.ORG link : CVE-2025-39994
JSON object : View
Products Affected
No product.
CWE
No CWE.