CVE-2025-39996
NoneCVSS
—
EPSS
0.2%
Published
Oct 15, 2025
CISA due date
—
Cloudanix analysis
A flaw in certain Linux systems using specific TV or media hardware cards could let a local attacker crash the system or gain elevated access if the hardware driver is removed while internal work is still running.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Privilege Gain
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Patch
- Effort
- Low
- Patch risk
- Low
What it actually does
Use-after-free in the Linux kernel b2c2 flexcop_pci driver where cancel_delayed_work() in flexcop_pci_remove() does not wait for irq_check_work to finish, allowing the work callback to dereference a freed flexcop_device structure after pci_device_remove and kfree.
Why it matters to the business
Kernel instability or crashes on systems with B2C2 FlexCop PCI hardware during driver unload or device removal, with low but non-zero risk of local privilege escalation; limited prevalence reduces broad operational impact but requires prompt kernel updates on affected distributions.
How an attack unfolds
A local attacker with access to trigger PCI device removal (via sysfs or module unload) races the delayed work callback; the work item runs after the device memory is freed, dereferencing invalid pointers and potentially leading to controlled memory corruption or information leaks.
How to fix it
Upgrade the Linux kernel to a version containing commit 607010d07b8a509b01ed15ea12744acac6536a98 or later; for SUSE Linux Enterprise Server 12 LTSS apply kgraft-patch-SLE12_Update_24 (version 10-2.1) or equivalent; rebuild and reboot with the patched kernel; avoid manual workarounds that leave the driver loaded.
How to confirm the fix worked
Verify the running kernel contains the fix commit or is newer than the vulnerable versions; inspect flexcop_pci_remove for use of cancel_delayed_work_sync instead of cancel_delayed_work; reproduce the race with QEMU-simulated device and KASAN enabled to confirm absence of slab-use-after-free reports.
Typical attack path
- Obtain local access on a system exposing the vulnerable b2c2 flexcop_pci driver
- Trigger flexcop_pci_remove via module unload, hot-unplug simulation, or sysfs remove_store
- Ensure irq_check_work is queued and executing with artificial delay
- Race the kfree of flexcop_device against the work callback's dereference of fc_pci->fc_dev
- Exploit resulting UAF for memory corruption or denial of service
How to detect it
Search kernel logs and crash dumps for KASAN reports referencing __run_timer_base, flexcop_pci_irq_check_work, or slab-use-after-free involving flexcop_device; examine dmesg for pci_device_remove followed by timer softirq faults in the b2c2 path.
- BUG: KASAN: slab-use-after-free in __run_timer_base
- flexcop_pci_irq_check_work
- flexcop_device_kfree
- fc_pci->fc_dev
What your security team should do
- Apply the fixed kernel version immediately on any system exposing the b2c2 driver
- Audit for presence of flexcop_pci module in production kernels and schedule reboots
- Monitor vendor advisories for backported patches in distribution kernels
- Enable KASAN or similar debug options in test environments to validate the fix
The record
In the Linux kernel, the following vulnerability has been resolved: media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove The original code uses cancel_delayed_work() in flexcop_pci_remove(), which does not guarantee that the delayed work item irq_check_work has fully completed if it was already running. This leads to use-after-free scenarios where flexcop_pci_remove() may free the flexcop_device while irq_check_work is still active and attempts to dereference the device. A typical race condition is illustrated below: CPU 0 (remove) | CPU 1 (delayed work callback) flexcop_pci_remove() | flexcop_pci_irq_check_work() cancel_delayed_work() | flexcop_device_kfree(fc_pci->fc_dev) | | fc = fc_pci->fc_dev; // UAF This is confirmed by a KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff8880093aa8c8 by task bash/135 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 run_timer_softirq+0xd1/0x190 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ> ... Allocated by task 1: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_noprof+0x1be/0x460 flexcop_device_kmalloc+0x54/0xe0 flexcop_pci_probe+0x1f/0x9d0 local_pci_probe+0xdc/0x190 pci_device_probe+0x2fe/0x470 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __driver_attach+0xd2/0x310 bus_for_each_dev+0xed/0x170 bus_add_driver+0x208/0x500 driver_register+0x132/0x460 do_one_initcall+0x89/0x300 kernel_init_freeable+0x40d/0x720 kernel_init+0x1a/0x150 ret_from_fork+0x10c/0x1a0 ret_from_fork_asm+0x1a/0x30 Freed by task 135: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 flexcop_device_kfree+0x32/0x50 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0xf8/0x210 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device_locked+0x15/0x30 remove_store+0xcc/0xe0 kernfs_fop_write_iter+0x2c3/0x440 vfs_write+0x871/0xd70 ksys_write+0xee/0x1c0 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work has finished before the device memory is deallocated. This bug was initially identified through static analysis. To reproduce and test it, I simulated the B2C2 FlexCop PCI device in QEMU and introduced artificial delays within the flexcop_pci_irq_check_work() function to increase the likelihood of triggering the bug.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Linux | Kernel | 2.6.29 | 5.4.301 |
| Linux | Kernel | 2.6.29 | 6.1.156 |
| Mageia:9 | kernel | 0 | 6.6.116-1.mga9 |
| Mageia:9 | kernel-linus | 0 | 6.6.116-1.mga9 |
| Mageia:9 | kmod-virtualbox | 0 | 7.1.14-13.mga9 |
| Mageia:9 | kmod-xtables-addons | 0 | 3.24-87.mga9 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_17 | 0 | 1-150600.1.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_17 | 0 | 1-150600.13.5.1 |
| SUSE:Linux Enterprise Live Patching 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_6 | 0 | 1-150700.15.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.78.1.150600.12.34.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-64kb | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-default-base | 0 | 6.4.0-150700.53.22.1.150700.17.15.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-source | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-zfcpdump | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-docs | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-obs-build | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-source | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-syms | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.55.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.55.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.55.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-azure | 0 | 6.4.0-150700.20.18.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-source-azure | 0 | 6.4.0-150700.20.18.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-syms-azure | 0 | 6.4.0-150700.20.18.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.58.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.58.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.58.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.55.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.78.1.150600.12.34.2 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.55.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.55.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 16.0 | dtb-aarch64 | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-64kb | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-default | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-default-base | 0 | 6.12.0-160000.6.1.160000.2.4 |
| openSUSE:Leap 16.0 | kernel-docs | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-kvmsmall | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-obs-build | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-obs-qa | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-rt | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-source | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-syms | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-zfcpdump | 0 | 6.12.0-160000.7.1 |
| openSUSE:Tumbleweed | kernel-source | 0 | 6.17.5-1.1 |
| openSUSE:Tumbleweed | kernel-source-longterm | 0 | 6.18.16-1.1 |
Related vulnerabilities
- CVE-2026-23226 In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock… Also affects Kernel
- CVE-2026-23225 In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Don't… Also affects Kernel
- CVE-2026-23230 In the Linux kernel, the following vulnerability has been resolved: smb: client: split… Also affects Kernel
- CVE-2026-23224 In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue… Also affects Kernel
- CVE-2026-23227 In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use… Also affects Kernel
- CVE-2026-23223 In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in… Also affects Kernel
- CVE-2026-23228 In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak… Also affects Kernel
- CVE-2026-23229 In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add… Also affects Kernel