{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39944","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.148Z","datePublished":"2025-10-04T07:31:06.339Z","dateUpdated":"2026-08-05T12:06:19.152Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:06:19.152Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()\n\nThe original code relies on cancel_delayed_work() in otx2_ptp_destroy(),\nwhich does not ensure that the delayed work item synctstamp_work has fully\ncompleted if it was already running. This leads to use-after-free scenarios\nwhere otx2_ptp is deallocated by otx2_ptp_destroy(), while synctstamp_work\nremains active and attempts to dereference otx2_ptp in otx2_sync_tstamp().\nFurthermore, the synctstamp_work is cyclic, the likelihood of triggering\nthe bug is nonnegligible.\n\nA typical race condition is illustrated below:\n\nCPU 0 (cleanup)           | CPU 1 (delayed work callback)\notx2_remove()             |\n  otx2_ptp_destroy()      | otx2_sync_tstamp()\n    cancel_delayed_work() |\n    kfree(ptp)            |\n                          |   ptp = container_of(...); //UAF\n                          |   ptp-> //UAF\n\nThis is confirmed by a KASAN report:\n\nBUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0\nWrite of size 8 at addr ffff88800aa09a18 by task bash/136\n...\nCall Trace:\n <IRQ>\n dump_stack_lvl+0x55/0x70\n print_report+0xcf/0x610\n ? __run_timer_base.part.0+0x7d7/0x8c0\n kasan_report+0xb8/0xf0\n ? __run_timer_base.part.0+0x7d7/0x8c0\n __run_timer_base.part.0+0x7d7/0x8c0\n ? __pfx___run_timer_base.part.0+0x10/0x10\n ? __pfx_read_tsc+0x10/0x10\n ? ktime_get+0x60/0x140\n ? lapic_next_event+0x11/0x20\n ? clockevents_program_event+0x1d4/0x2a0\n run_timer_softirq+0xd1/0x190\n handle_softirqs+0x16a/0x550\n irq_exit_rcu+0xaf/0xe0\n sysvec_apic_timer_interrupt+0x70/0x80\n </IRQ>\n...\nAllocated by task 1:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x7f/0x90\n otx2_ptp_init+0xb1/0x860\n otx2_probe+0x4eb/0xc30\n local_pci_probe+0xdc/0x190\n pci_device_probe+0x2fe/0x470\n really_probe+0x1ca/0x5c0\n __driver_probe_device+0x248/0x310\n driver_probe_device+0x44/0x120\n __driver_attach+0xd2/0x310\n bus_for_each_dev+0xed/0x170\n bus_add_driver+0x208/0x500\n driver_register+0x132/0x460\n do_one_initcall+0x89/0x300\n kernel_init_freeable+0x40d/0x720\n kernel_init+0x1a/0x150\n ret_from_fork+0x10c/0x1a0\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 136:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3a/0x60\n __kasan_slab_free+0x3f/0x50\n kfree+0x137/0x370\n otx2_ptp_destroy+0x38/0x80\n otx2_remove+0x10d/0x4c0\n pci_device_remove+0xa6/0x1d0\n device_release_driver_internal+0xf8/0x210\n pci_stop_bus_device+0x105/0x150\n pci_stop_and_remove_bus_device_locked+0x15/0x30\n remove_store+0xcc/0xe0\n kernfs_fop_write_iter+0x2c3/0x440\n vfs_write+0x871/0xd70\n ksys_write+0xee/0x1c0\n do_syscall_64+0xac/0x280\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n\nReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure\nthat the delayed work item is properly canceled before the otx2_ptp is\ndeallocated.\n\nThis bug was initially identified through static analysis. To reproduce\nand test it, I simulated the OcteonTX2 PCI device in QEMU and introduced\nartificial delays within the otx2_sync_tstamp() function to increase the\nlikelihood of triggering the bug."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Both halves of the race are driven by local operations — a `SIOCSHWTSTAMP`/ethtool tsconfig request on the octeontx2 netdev to arm the cyclic `synctstamp_work`, and local driver unbind/SR-IOV teardown/shutdown that reaches `otx2_ptp_destroy()`. No remotely supplied packet data reaches `otx2_sync_tstamp()`.\nAC:L - The attacker controls both sides: enabling `HWTSTAMP_TX_ONESTEP_SYNC` keeps the work self-requeuing every 250 ms indefinitely, and the callback blocks on `pfvf->mbox.lock` plus a mailbox round-trip with a 6000 ms timeout that the attacker can widen at will with concurrent mbox-consuming netdev operations, so the free reliably lands while the work is in flight (the commit itself notes the cyclic work makes the likelihood \"nonnegligible\"), and failed attempts are freely repeatable.\nPR:L - Arming the racing work requires only `ns_capable(net->user_ns, CAP_NET_ADMIN)`, which an unprivileged host user obtains inside a user namespace over an SR-IOV VF delegated to their container/pod; the free side is then driven by attacker-induced VF teardown/driver rebind on container exit or by routine unbind/`.shutdown = otx2_remove`, with no real root needed by the attacker.\nUI:N - The attacker performs the hwtstamp configuration and induces the device teardown itself; no victim must open a file, mount anything, or otherwise cooperate.\nS:U - The use-after-free corrupts kernel slab memory and is exploited entirely within the kernel's own security authority, crossing no hypervisor, IOMMU, or sandbox boundary.\nC:H - After `kfree(ptp)` the still-running callback reads `ptp->nic`, the timecounter state, and function pointers out of the reclaimed slab object, and the derived `ptp->nic->mbox` pointer lets the attacker steer firmware mailbox reads/writes at attacker-chosen kernel addresses, giving a path to disclose arbitrary kernel memory.\nI:H - `otx2_sync_tstamp()` makes an indirect call through `ptp->ptp_tstamp2nsec` located inside the freed allocation — a direct control-flow hijack primitive after heap grooming — and also writes `ptp->tstamp`/`ptp->base_ns` at fixed offsets into the reclaimed object, with the 250 ms self-requeue granting unlimited retries.\nA:H - The `delayed_work` timer is re-armed on `kfree()`d memory and fires every 250 ms forever, so even an unsuccessful attempt produces slab corruption, the KASAN-reported UAF write in `__run_timer_base`, and a kernel oops or panic."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c"],"versions":[{"version":"2958d17a898416c6193431676f6130b68a2cb9fc","lessThan":"2786879aebf363806a13d41e8d5f99202ddd23d9","status":"affected","versionType":"git"},{"version":"2958d17a898416c6193431676f6130b68a2cb9fc","lessThan":"d2cfefa14ce8137b17f99683f968bebf134b6a48","status":"affected","versionType":"git"},{"version":"2958d17a898416c6193431676f6130b68a2cb9fc","lessThan":"ff27e23b311fed4d25e3852e27ba693416d4c7b3","status":"affected","versionType":"git"},{"version":"2958d17a898416c6193431676f6130b68a2cb9fc","lessThan":"5ca20bb7b4bde72110c3ae78423cbfdd0157aa36","status":"affected","versionType":"git"},{"version":"2958d17a898416c6193431676f6130b68a2cb9fc","lessThan":"f8b4687151021db61841af983f1cb7be6915d4ef","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c"],"versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","status":"unaffected","versionType":"semver"},{"version":"6.1.154","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.108","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.49","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.16.9","lessThanOrEqual":"6.16.*","status":"unaffected","versionType":"semver"},{"version":"6.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.1.154"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.6.108"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.12.49"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.16.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.17"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/2786879aebf363806a13d41e8d5f99202ddd23d9"},{"url":"https://git.kernel.org/stable/c/d2cfefa14ce8137b17f99683f968bebf134b6a48"},{"url":"https://git.kernel.org/stable/c/ff27e23b311fed4d25e3852e27ba693416d4c7b3"},{"url":"https://git.kernel.org/stable/c/5ca20bb7b4bde72110c3ae78423cbfdd0157aa36"},{"url":"https://git.kernel.org/stable/c/f8b4687151021db61841af983f1cb7be6915d4ef"}],"title":"octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()","x_generator":{"engine":"bippy-1.2.0"}}}}