cbcvebase.
CVE-2025-39996
published 2025-10-15

CVE-2025-39996: In the Linux kernel, the following vulnerability has been resolved: media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove The…

PriorityP425critical9.8
EPSS
0.22%
12.3th percentile
In the Linux kernel, the following vulnerability has been resolved: media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove The original code uses cancel_delayed_work() in flexcop_pci_remove(), which does not guarantee that the delayed work item irq_check_work has fully completed if it was already running. This leads to use-after-free scenarios where flexcop_pci_remove() may free the flexcop_device while irq_check_work is still active and attempts to dereference the device. A typical race condition is illustrated below: CPU 0 (remove) | CPU 1 (delayed work callback) flexcop_pci_remove() | flexcop_pci_irq_check_work() cancel_delayed_work() | flexcop_device_kfree(fc_pci->fc_dev) | | fc = fc_pci->fc_dev; // UAF This is confirmed by a KASAN report: BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff8880093aa8c8 by task bash/135 ... Call Trace: dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 run_timer_softirq+0xd1/0x190 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 ... Allocated by task 1: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_noprof+0x1be/0x460 flexcop_device_kmalloc+0x54/0xe0 flexcop_pci_probe+0x1f/0x9d0 local_pci_probe+0xdc/0x190 pci_device_probe+0x2fe/0x470 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __driver_attach+0xd2/0x310 bus_for_each_dev+0xed/0x170 bus_add_driver+0x208/0x500 driver_register+0x132/0x460 do_one_initcall+0x89/0x300 kernel_init_freeable+0x40d/0x720 kernel_init+0x1a/0x150 ret_from_fork+0x10c/0x1a0 ret_from_fork_asm+0x1a/0x30 Freed by task

Affected

31 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.158-1 (bookworm)linux 6.1.158-1 (bookworm)
debianlinux-6.1< linux 6.1.158-1 (bookworm)linux 6.1.158-1 (bookworm)
linuxlinux
linuxlinux>= 382c5546d618f24dc7d6ae7ca33412083720efbf < 607010d07b8a509b01ed15ea12744acac6536a98607010d07b8a509b01ed15ea12744acac6536a98
linuxlinux>= 382c5546d618f24dc7d6ae7ca33412083720efbf < bde8173def374230226e8554efb51b271f4066ecbde8173def374230226e8554efb51b271f4066ec
linuxlinux>= 382c5546d618f24dc7d6ae7ca33412083720efbf < 120e221b4bbe9d0f6c09b5c4dc53ca4ad91d956b120e221b4bbe9d0f6c09b5c4dc53ca4ad91d956b
linuxlinux>= 382c5546d618f24dc7d6ae7ca33412083720efbf < d502df8a716d993fa0f9d8c00684f1190750e28ed502df8a716d993fa0f9d8c00684f1190750e28e
linuxlinux>= 382c5546d618f24dc7d6ae7ca33412083720efbf < bb10a9ddc8d6c5dbf098f21eb1055a652652e524bb10a9ddc8d6c5dbf098f21eb1055a652652e524
linuxlinux>= 382c5546d618f24dc7d6ae7ca33412083720efbf < 514a519baa9e2be7ddc2714bd730bc5a883e1244514a519baa9e2be7ddc2714bd730bc5a883e1244
linuxlinux>= 382c5546d618f24dc7d6ae7ca33412083720efbf < 3ffabc79388e68877d9c02f724a0b7a38d519daf3ffabc79388e68877d9c02f724a0b7a38d519daf
linuxlinux>= 382c5546d618f24dc7d6ae7ca33412083720efbf < 6a92f5796880f5aa345f0fed53ef511e3fd6f7066a92f5796880f5aa345f0fed53ef511e3fd6f706
linuxlinux>= 382c5546d618f24dc7d6ae7ca33412083720efbf < 01e03fb7db419d39e18d6090d4873c1bff10391401e03fb7db419d39e18d6090d4873c1bff103914
linuxlinux_kernel>= 0 < 5.10.247-15.10.247-1
linuxlinux_kernel>= 0 < 6.1.158-16.1.158-1
linuxlinux_kernel>= 0 < 6.12.57-16.12.57-1
linuxlinux_kernel>= 0 < 6.16.11-16.16.11-1
linuxlinux_kernel>= 0 < 5.15.0-170.1805.15.0-170.180
linuxlinux_kernel>= 0 < 6.8.0-106.1066.8.0-106.106
linuxlinux_kernel>= 2.6.29 < 5.4.3015.4.301
linuxlinux_kernel>= 5.11.0 < 5.15.1955.15.195
linuxlinux_kernel>= 5.16.0 < 6.1.1566.1.156
linuxlinux_kernel>= 5.5.0 < 5.10.2465.10.246
linuxlinux_kernel>= 6.13.0 < 6.16.116.16.11
linuxlinux_kernel>= 6.17.0 < 6.17.16.17.1
linuxlinux_kernel>= 6.2.0 < 6.6.1106.6.110

CVSS provenance

vendor_msrc9.8CRITICAL
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.