CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog
In the Linux kernel, the following vulnerability has been resolved:
ptp: ocp: fix use-after-free bugs causing by ptpocpwatchdog
The ptpocpdetach() only shuts down the watchdog timer if it is pending. However, if the timer handler is already running, the timerdeletesync() is not called. This leads to race conditions where the devlink that contains the ptpocp is deallocated while the timer handler is still accessing it, resulting in use-after-free bugs. The following details one of the race scenarios.
(thread 1) | (thread 2) ptpocpremove() | ptpocpdetach() | ptpocpwatchdog() if (timerpending(&bp->watchdog))| bp = timercontainerof() timerdeletesync() | | devlinkfree(devlink) //free | | bp-> //use
Resolve this by unconditionally calling timerdeletesync() to ensure the timer is reliably deactivated, preventing any access after free.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39859?
CVE-2025-39859 is categorized as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-39859?
To fix CVE-2025-39859, you should update to the latest version of the Linux kernel where this vulnerability has been resolved.
What type of vulnerability is CVE-2025-39859?
CVE-2025-39859 is a use-after-free vulnerability related to the ptp_ocp_watchdog functionality in the Linux kernel.
Which versions of Linux kernel are affected by CVE-2025-39859?
CVE-2025-39859 affects multiple versions of the Linux kernel prior to the fix being applied.
What is the impact of CVE-2025-39859 on systems?
The impact of CVE-2025-39859 can potentially lead to crashes or the execution of arbitrary code due to the use-after-free condition.