CVE-2025-39978

What it actually does

The vulnerability is a use-after-free in the Linux kernel octeontx2-pf driver where kfree_rcu(new_node, rcu) is called and new_node is subsequently dereferenced in otx2_tc_add_flow outside an RCU-safe region.

Why it matters to the business

Potential kernel crashes, memory corruption, or local privilege escalation on affected Xen-based SUSE Linux systems and upstream stable kernels, raising operational risk and requiring prompt updates across environments using these packages.

How an attack unfolds

An attacker with local access triggers the otx2_tc_add_flow path, causing the driver to queue a node for RCU free then immediately dereference it, resulting in memory corruption that can be leveraged for privilege escalation, consistent with patterns seen in related Linux kernel exploits by groups such as VMSCAPE.

How to fix it

Apply the fixed versions: SUSE Xen packages updated to 4.5.5_24-22.52.3 and Linux stable kernels updated to commit 5723120423a753a220b8b2954b273838b9d7e74a.

How to confirm the fix worked

Confirm the running kernel or package version matches a listed fixed release; review source or changelog for the reordered dereference before kfree_rcu in otx2_tc_add_flow.

Typical attack path

1. Obtain local unprivileged access to an affected system
2. Invoke network traffic control configuration that reaches otx2_tc_add_flow
3. Trigger the erroneous post-kfree_rcu dereference to corrupt memory
4. Escalate privileges or induce denial of service via the resulting use-after-free

How to detect it

Review kernel logs for oops or panic messages referencing octeontx2-pf or otx2_tc_add_flow; search audit trails for unexpected traffic control rule additions followed by crashes on systems running vulnerable versions.

What your security team should do

• Immediately upgrade affected SUSE Xen and Linux stable deployments to the listed fixed versions
• Limit local access and network configuration privileges on unpatched systems
• Incorporate the fix into standard kernel update and validation processes