CVE-2025-39859

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog

The ptp_ocp_detach() only shuts down the watchdog timer if it is

pending. However, if the timer handler is already running, the

timer_delete_sync() is not called. This leads to race conditions

where the devlink that contains the ptp_ocp is deallocated while

the timer handler is still accessing it, resulting in use-after-free

bugs. The following details one of the race scenarios.

(thread 1) | (thread 2)

ptp_ocp_remove() |

ptp_ocp_detach() | ptp_ocp_watchdog()

if (timer_pending(&bp->watchdog))| bp = timer_container_of()

timer_delete_sync() |

|

devlink_free(devlink) //free |

| bp-> //use

Resolve this by unconditionally calling timer_delete_sync() to ensure

the timer is reliably deactivat

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References