CVE-2025-39859
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-39859
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-39859.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-39859
- Downstream
- Published
- 2025-09-19T15:26:29.717Z
- Modified
- 2025-12-02T19:30:34.329118Z
- Summary
- ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ptp: ocp: fix use-after-free bugs causing by ptpocpwatchdog
The ptpocpdetach() only shuts down the watchdog timer if it is pending. However, if the timer handler is already running, the timerdeletesync() is not called. This leads to race conditions where the devlink that contains the ptp_ocp is deallocated while the timer handler is still accessing it, resulting in use-after-free bugs. The following details one of the race scenarios.
(thread 1) | (thread 2) ptpocpremove() | ptpocpdetach() | ptpocpwatchdog() if (timerpending(&bp->watchdog))| bp = timercontainerof() timerdeletesync() | | devlinkfree(devlink) //free | | bp-> //use
Resolve this by unconditionally calling timerdeletesync() to ensure the timer is reliably deactivated, preventing any access after free.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39859.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/8bf935cf789872350b04c1a6468b0a509f67afb2
- https://git.kernel.org/stable/c/f10d3c7267ac7387a5129d5506c3c5f2460cfd9b
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39859.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-39859
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced773bda96492153e11d21eb63ac814669b51fc701Fixedf10d3c7267ac7387a5129d5506c3c5f2460cfd9bFixed8bf935cf789872350b04c1a6468b0a509f67afb2