CVE-2025-40003

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work

The origin code calls cancel_delayed_work() in ocelot_stats_deinit()

to cancel the cyclic delayed work item ocelot->stats_work. However,

cancel_delayed_work() may fail to cancel the work item if it is already

executing. While destroy_workqueue() does wait for all pending work items

in the work queue to complete before destroying the work queue, it cannot

prevent the delayed work item from being rescheduled within the

ocelot_check_stats_work() function. This limitation exists because the

delayed work item is only enqueued into the work queue after its timer

expires. Before the timer expiration, destroy_workqueue() has no visibility

of this pending work item. Once the work queue appears empty,

destroy_workqueue() proceeds with destruction. When the timer eventually

expires, the delayed work item gets queued again, leading to the following

warning:

wor

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References