CVE-2025-39872: hsr: hold rcu and dev lock for hsr_get_port_ndev
In the Linux kernel, the following vulnerability has been resolved:
hsr: hold rcu and dev lock for hsrgetportndev
hsrgetportndev calls hsrforeachport, which need to hold rcu lock. On the other hand, before return the port device, we need to hold the device reference to avoid UaF in the caller function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39872?
CVE-2025-39872 has been classified with a moderate severity level due to the potential impact on system stability.
How do I fix CVE-2025-39872?
To fix CVE-2025-39872, you should update to the latest version of the Linux kernel that contains the security patch.
What systems are affected by CVE-2025-39872?
CVE-2025-39872 affects various versions of the Linux kernel.
What does CVE-2025-39872 exploit?
CVE-2025-39872 exploits a race condition in the hsr_get_port_ndev function, which may lead to improper handling of device references.
When was CVE-2025-39872 first reported?
CVE-2025-39872 was first reported in 2025 and addressed in subsequent kernel updates.