Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-39996— media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于flexcop_pci_remove中irq_check_work的释放后重用问题，可能导致内存损坏。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.23% · P13

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux 382c5546d618f24dc7d6ae7ca33412083720efbf< 607010d07b8a509b01ed15ea12744acac6536a98 affected
382c5546d618f24dc7d6ae7ca33412083720efbf< bde8173def374230226e8554efb51b271f4066ec affected
382c5546d618f24dc7d6ae7ca33412083720efbf< 120e221b4bbe9d0f6c09b5c4dc53ca4ad91d956b affected
382c5546d618f24dc7d6ae7ca33412083720efbf< d502df8a716d993fa0f9d8c00684f1190750e28e affected
382c5546d618f24dc7d6ae7ca33412083720efbf< bb10a9ddc8d6c5dbf098f21eb1055a652652e524 affected
382c5546d618f24dc7d6ae7ca33412083720efbf< 514a519baa9e2be7ddc2714bd730bc5a883e1244 affected
382c5546d618f24dc7d6ae7ca33412083720efbf< 3ffabc79388e68877d9c02f724a0b7a38d519daf affected
382c5546d618f24dc7d6ae7ca33412083720efbf< 6a92f5796880f5aa345f0fed53ef511e3fd6f706 affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-39996

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove The original code uses cancel_delayed_work() in flexcop_pci_remove(), which does not guarantee that the delayed work item irq_check_work has fully completed if it was already running. This leads to use-after-free scenarios where flexcop_pci_remove() may free the flexcop_device while irq_check_work is still active and attempts to dereference the device. A typical race condition is illustrated below: CPU 0 (remove) | CPU 1 (delayed work callback) flexcop_pci_remove() | flexcop_pci_irq_check_work() cancel_delayed_work() | flexcop_device_kfree(fc_pci->fc_dev) | | fc = fc_pci->fc_dev; // UAF This is confirmed by a KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff8880093aa8c8 by task bash/135 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 run_timer_softirq+0xd1/0x190 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ> ... Allocated by task 1: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_noprof+0x1be/0x460 flexcop_device_kmalloc+0x54/0xe0 flexcop_pci_probe+0x1f/0x9d0 local_pci_probe+0xdc/0x190 pci_device_probe+0x2fe/0x470 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __driver_attach+0xd2/0x310 bus_for_each_dev+0xed/0x170 bus_add_driver+0x208/0x500 driver_register+0x132/0x460 do_one_initcall+0x89/0x300 kernel_init_freeable+0x40d/0x720 kernel_init+0x1a/0x150 ret_from_fork+0x10c/0x1a0 ret_from_fork_asm+0x1a/0x30 Freed by task 135: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 flexcop_device_kfree+0x32/0x50 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0xf8/0x210 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device_locked+0x15/0x30 remove_store+0xcc/0xe0 kernfs_fop_write_iter+0x2c3/0x440 vfs_write+0x871/0xd70 ksys_write+0xee/0x1c0 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work has finished before the device memory is deallocated. This bug was initially identified through static analysis. To reproduce and test it, I simulated the B2C2 FlexCop PCI device in QEMU and introduced artificial delays within the flexcop_pci_irq_check_work() function to increase the likelihood of triggering the bug.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于flexcop_pci_remove中irq_check_work的释放后重用问题，可能导致内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 382c5546d618f24dc7d6ae7ca33412083720efbf ~ 607010d07b8a509b01ed15ea12744acac6536a98 -
Linux Linux 2.6.29 -

II. Public POCs for CVE-2025-39996

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-39996

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-39996 (2)

Same Patch Batch · Linux · 2025-10-15 · 34 CVEs total

CVE-2025-39975 9.8 CRITICAL smb: client: fix wrong index reference in smb2_compound_op()
CVE-2025-40000 8.8 HIGH wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
CVE-2025-39969 8.8 HIGH i40e: fix validation of VF state in get resources
CVE-2025-39971 8.8 HIGH i40e: fix idx validation in config queues msg
CVE-2025-39970 8.8 HIGH i40e: fix input validation logic for action_meta
CVE-2025-39972 8.8 HIGH i40e: fix idx validation in i40e_validate_queue_map
CVE-2025-39973 8.8 HIGH i40e: add validation for ring_len param
CVE-2025-39983 8.8 HIGH Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue
CVE-2025-39982 8.8 HIGH Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
CVE-2025-39966 7.8 HIGH iommufd: Fix race during abort for file descriptors
CVE-2025-39967 7.8 HIGH fbcon: fix integer overflow in fbcon_do_set_font
CVE-2025-39976 7.8 HIGH futex: Use correct exit on failure from futex_hash_allocate_default()
CVE-2025-39977 7.8 HIGH futex: Prevent use-after-free during requeue-PI
CVE-2025-39978 7.8 HIGH octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
CVE-2025-39979 7.8 HIGH net/mlx5: fs, fix UAF in flow counter release
CVE-2025-39981 7.8 HIGH Bluetooth: MGMT: Fix possible UAFs
CVE-2025-39985 7.8 HIGH can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
CVE-2025-39986 7.8 HIGH can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
CVE-2025-39987 7.8 HIGH can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
CVE-2025-39988 7.8 HIGH can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow

Showing top 20 of 34 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-39996

No comments yet

Leave a comment