CVE-2025-39996

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove

The original code uses cancel_delayed_work() in flexcop_pci_remove(), which

does not guarantee that the delayed work item irq_check_work has fully

completed if it was already running. This leads to use-after-free scenarios

where flexcop_pci_remove() may free the flexcop_device while irq_check_work

is still active and attempts to dereference the device.

A typical race condition is illustrated below:

CPU 0 (remove) | CPU 1 (delayed work callback)

flexcop_pci_remove() | flexcop_pci_irq_check_work()

cancel_delayed_work() |

flexcop_device_kfree(fc_pci->fc_dev) |

| fc = fc_pci->fc_dev; // UAF

This is confirmed by a KASAN report:

==================================================================

BUG: KASAN: slab-use-after-free in __run_timer

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References