CVE-2025-39944: Linux Kernel Use-After-Free Vulnerability

CVE-2025-39944 is a use-after-free flaw in the Linux kernel's OcteonTX2-PF driver affecting timestamp synchronization. Attackers could exploit this race condition to cause system crashes or instability. This post covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2025-39944 Overview

CVE-2025-39944 is a use-after-free vulnerability [CWE-416] in the Linux kernel's octeontx2-pf network driver. The flaw resides in the otx2_sync_tstamp() function, which handles Precision Time Protocol (PTP) timestamp synchronization for Marvell OcteonTX2 network adapters. The otx2_ptp_destroy() function uses cancel_delayed_work() to stop the cyclic synctstamp_work delayed work item. This call does not wait for an already-running work item to finish. As a result, the kernel can free the otx2_ptp structure while the delayed work continues to dereference it, leading to memory corruption.

Critical Impact
A local attacker with the ability to trigger driver removal on an affected OcteonTX2 system can exploit the race condition to corrupt kernel memory, potentially escalating privileges or crashing the host.

Affected Products

Linux Kernel stable branches prior to the fix commits
Linux Kernel 6.17 release candidates rc1 through rc6
Systems using the Marvell OcteonTX2 physical function (octeontx2-pf) driver

Discovery Timeline

2025-10-04 - CVE-2025-39944 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-39944

Vulnerability Analysis

The octeontx2-pf driver initializes PTP hardware timestamping through otx2_ptp_init(), which allocates an otx2_ptp structure and schedules the synctstamp_work delayed work item. The work item is cyclic and repeatedly reschedules itself to synchronize hardware timestamps with the host clock. On driver teardown, otx2_remove() invokes otx2_ptp_destroy(), which calls cancel_delayed_work() and then frees the otx2_ptp allocation via kfree(). The cancel_delayed_work() API only prevents future executions of the work item. It returns immediately without waiting for an in-flight callback to complete. When synctstamp_work is executing on another CPU during teardown, the free occurs while the callback still holds a pointer to the freed structure through container_of(), producing a use-after-free write that KASAN flags in __run_timer_base.

Root Cause

The root cause is incorrect synchronization between resource deallocation and asynchronous work execution. cancel_delayed_work() provides no completion guarantee for running work; only cancel_delayed_work_sync() blocks until the work callback returns. The cyclic nature of synctstamp_work increases the window in which the race can occur, making the bug reachable during normal PCI device removal.

Attack Vector

Exploitation requires local access with the ability to trigger driver unbind or PCI device removal on a host with the octeontx2-pf driver bound to an OcteonTX2 network adapter. An attacker with CAP_SYS_ADMIN or write access to sysfs PCI removal interfaces such as /sys/bus/pci/devices/*/remove can force the teardown path. If the delayed work is executing during the race window, the freed otx2_ptp object is written to, producing kernel memory corruption. The condition is deterministic enough that the reporter reproduced it in QEMU by injecting artificial delays into otx2_sync_tstamp().

The vulnerability is described in prose only because no verified public exploit code has been released. See the linked kernel commits for the corrective patch.

Detection Methods for CVE-2025-39944

Indicators of Compromise

KASAN reports referencing slab-use-after-free in __run_timer_base.part.0 with allocation traces originating from otx2_ptp_init and free traces from otx2_ptp_destroy
Unexpected kernel oops or panic messages generated during PCI unbind of OcteonTX2 network devices
Repeated driver rebind or removal events on hosts using octeontx2-pf

Detection Strategies

Enable KASAN on test and staging kernels to surface use-after-free access in the PTP delayed work path
Monitor dmesg and kernel audit logs for stack traces containing otx2_sync_tstamp, otx2_ptp_destroy, and run_timer_softirq
Track writes to PCI remove and unbind sysfs entries associated with OcteonTX2 devices

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on KASAN and BUG: strings referencing PTP or octeontx2 symbols
Baseline the running kernel version across fleet inventory to identify hosts still exposed to CVE-2025-39944
Audit which local users and processes hold privileges that allow PCI device removal on affected hardware

How to Mitigate CVE-2025-39944

Immediate Actions Required

Apply the upstream stable kernel patches that replace cancel_delayed_work() with cancel_delayed_work_sync() in otx2_ptp_destroy()
Restrict local access on systems running octeontx2-pf until patched kernels are deployed
Limit write access to PCI removal and unbind sysfs interfaces to trusted administrative accounts only

Patch Information

The fix is delivered across multiple stable branches. See Kernel Git Commit 2786879a, Kernel Git Commit 5ca20bb7, Kernel Git Commit d2cfefa1, Kernel Git Commit f8b46871, and Kernel Git Commit ff27e23b. Update to a distribution kernel that incorporates these commits and reboot affected hosts.

Workarounds

Where patching is not immediately possible, unbind or blacklist the octeontx2-pf driver on non-essential systems
Restrict CAP_SYS_ADMIN and access to /sys/bus/pci/devices/*/remove to a minimal set of accounts
Avoid repeated driver rebind operations on production systems until the fix is applied