CVE-2025-39945

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cnic: Fix use-after-free bugs in cnic_delete_task

The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(),

which does not guarantee that the delayed work item 'delete_task' has

fully completed if it was already running. Additionally, the delayed work

item is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only

blocks and waits for work items that were already queued to the

workqueue prior to its invocation. Any work items submitted after

flush_workqueue() is called are not included in the set of tasks that the

flush operation awaits. This means that after the cyclic work items have

finished executing, a delayed work item may still exist in the workqueue.

This leads to use-after-free scenarios where the cnic_dev is deallocated

by cnic_free_dev(), while delete_task remains active and attempt to

dereference cnic_dev in cnic_delete_task().

A typical race condition is illustrated below:

CPU 0 (c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References