CVE-2025-39944

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()

The original code relies on cancel_delayed_work() in otx2_ptp_destroy(),

which does not ensure that the delayed work item synctstamp_work has fully

completed if it was already running. This leads to use-after-free scenarios

where otx2_ptp is deallocated by otx2_ptp_destroy(), while synctstamp_work

remains active and attempts to dereference otx2_ptp in otx2_sync_tstamp().

Furthermore, the synctstamp_work is cyclic, the likelihood of triggering

the bug is nonnegligible.

A typical race condition is illustrated below:

CPU 0 (cleanup) | CPU 1 (delayed work callback)

otx2_remove() |

otx2_ptp_destroy() | otx2_sync_tstamp()

cancel_delayed_work() |

kfree(ptp) |

| ptp = container_of(...); //UAF

| ptp-> //UAF

This is confirmed by a KASAN report:

BUG: KASAN: slab-

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References