CVE-2025-39994

What it actually does

Use-after-free in the xc5000 tuner driver where cancel_delayed_work() allows the timer_sleep delayed work item to dereference freed xc5000_priv memory after hybrid_tuner_release_state() calls kfree.

Why it matters to the business

Potential kernel crashes, memory corruption, or local privilege escalation on systems using the xc5000 tuner, increasing risk for Linux servers and embedded devices; no widespread ransomware use but kernel exposure affects many deployments.

How an attack unfolds

An attacker with local access triggers xc5000_release() concurrently with a pending timer_sleep work item; cancel_delayed_work() returns without waiting, the priv struct is freed, and the work callback later performs a container_of dereference on the freed memory leading to UAF.

How to fix it

Apply kernel patches replacing cancel_delayed_work() with cancel_delayed_work_sync() in xc5000_release(); update to fixed versions including SUSE kgraft-patch-SLE12-SP1_Update_23 6-2.1 or mainline commit bc4ffd962ce16a154c44c68853b9d93f5b6fc4b8 and later stable trees.

How to confirm the fix worked

Verify the presence of cancel_delayed_work_sync() in xc5000_release() via source inspection or kernel binary diff; confirm updated package versions on SUSE and GIT trees; test module unload under load to ensure no delayed work races remain.

Typical attack path

1. Obtain local code execution on affected Linux system
2. Load or trigger the xc5000 tuner module to schedule timer_sleep
3. Race xc5000_release() against the delayed work callback
4. Trigger use-after-free via the dangling priv pointer in timer_sleep

How to detect it

Inspect kernel logs for use-after-free warnings or slab corruption around xc5000_priv and timer_sleep; correlate with module load/unload events or media device open/close sequences; review audit logs for unexpected tuner driver activity on systems with the vulnerable module.

What your security team should do

• Prioritize patching kernel packages on all systems using xc5000 or related media tuners within 30 days
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict untrusted local access on systems exposing tuner hardware until patched
• Review similar delayed-work patterns in other tuner and hybrid_tuner drivers for related issues