CVE-2025-39944 (GCVE-0-2025-39944)

Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2026-08-05 12:06
VLAI
Title
octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
Summary
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() The original code relies on cancel_delayed_work() in otx2_ptp_destroy(), which does not ensure that the delayed work item synctstamp_work has fully completed if it was already running. This leads to use-after-free scenarios where otx2_ptp is deallocated by otx2_ptp_destroy(), while synctstamp_work remains active and attempts to dereference otx2_ptp in otx2_sync_tstamp(). Furthermore, the synctstamp_work is cyclic, the likelihood of triggering the bug is nonnegligible. A typical race condition is illustrated below: CPU 0 (cleanup) | CPU 1 (delayed work callback) otx2_remove() | otx2_ptp_destroy() | otx2_sync_tstamp() cancel_delayed_work() | kfree(ptp) | | ptp = container_of(...); //UAF | ptp-> //UAF This is confirmed by a KASAN report: BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff88800aa09a18 by task bash/136 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 run_timer_softirq+0xd1/0x190 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ> ... Allocated by task 1: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 otx2_ptp_init+0xb1/0x860 otx2_probe+0x4eb/0xc30 local_pci_probe+0xdc/0x190 pci_device_probe+0x2fe/0x470 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __driver_attach+0xd2/0x310 bus_for_each_dev+0xed/0x170 bus_add_driver+0x208/0x500 driver_register+0x132/0x460 do_one_initcall+0x89/0x300 kernel_init_freeable+0x40d/0x720 kernel_init+0x1a/0x150 ret_from_fork+0x10c/0x1a0 ret_from_fork_asm+0x1a/0x30 Freed by task 136: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 otx2_ptp_destroy+0x38/0x80 otx2_remove+0x10d/0x4c0 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0xf8/0x210 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device_locked+0x15/0x30 remove_store+0xcc/0xe0 kernfs_fop_write_iter+0x2c3/0x440 vfs_write+0x871/0xd70 ksys_write+0xee/0x1c0 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled before the otx2_ptp is deallocated. This bug was initially identified through static analysis. To reproduce and test it, I simulated the OcteonTX2 PCI device in QEMU and introduced artificial delays within the otx2_sync_tstamp() function to increase the likelihood of triggering the bug.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2958d17a898416c6193431676f6130b68a2cb9fc , < 2786879aebf363806a13d41e8d5f99202ddd23d9 (git)
Affected: 2958d17a898416c6193431676f6130b68a2cb9fc , < d2cfefa14ce8137b17f99683f968bebf134b6a48 (git)
Affected: 2958d17a898416c6193431676f6130b68a2cb9fc , < ff27e23b311fed4d25e3852e27ba693416d4c7b3 (git)
Affected: 2958d17a898416c6193431676f6130b68a2cb9fc , < 5ca20bb7b4bde72110c3ae78423cbfdd0157aa36 (git)
Affected: 2958d17a898416c6193431676f6130b68a2cb9fc , < f8b4687151021db61841af983f1cb7be6915d4ef (git)
Create a notification for this product.
Linux Linux Affected: 6.1
Unaffected: 0 , < 6.1 (semver)
Unaffected: 6.1.154 , ≤ 6.1.* (semver)
Unaffected: 6.6.108 , ≤ 6.6.* (semver)
Unaffected: 6.12.49 , ≤ 6.12.* (semver)
Unaffected: 6.16.9 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2786879aebf363806a13d41e8d5f99202ddd23d9",
              "status": "affected",
              "version": "2958d17a898416c6193431676f6130b68a2cb9fc",
              "versionType": "git"
            },
            {
              "lessThan": "d2cfefa14ce8137b17f99683f968bebf134b6a48",
              "status": "affected",
              "version": "2958d17a898416c6193431676f6130b68a2cb9fc",
              "versionType": "git"
            },
            {
              "lessThan": "ff27e23b311fed4d25e3852e27ba693416d4c7b3",
              "status": "affected",
              "version": "2958d17a898416c6193431676f6130b68a2cb9fc",
              "versionType": "git"
            },
            {
              "lessThan": "5ca20bb7b4bde72110c3ae78423cbfdd0157aa36",
              "status": "affected",
              "version": "2958d17a898416c6193431676f6130b68a2cb9fc",
              "versionType": "git"
            },
            {
              "lessThan": "f8b4687151021db61841af983f1cb7be6915d4ef",
              "status": "affected",
              "version": "2958d17a898416c6193431676f6130b68a2cb9fc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.154",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.108",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.9",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()\n\nThe original code relies on cancel_delayed_work() in otx2_ptp_destroy(),\nwhich does not ensure that the delayed work item synctstamp_work has fully\ncompleted if it was already running. This leads to use-after-free scenarios\nwhere otx2_ptp is deallocated by otx2_ptp_destroy(), while synctstamp_work\nremains active and attempts to dereference otx2_ptp in otx2_sync_tstamp().\nFurthermore, the synctstamp_work is cyclic, the likelihood of triggering\nthe bug is nonnegligible.\n\nA typical race condition is illustrated below:\n\nCPU 0 (cleanup)           | CPU 1 (delayed work callback)\notx2_remove()             |\n  otx2_ptp_destroy()      | otx2_sync_tstamp()\n    cancel_delayed_work() |\n    kfree(ptp)            |\n                          |   ptp = container_of(...); //UAF\n                          |   ptp-\u003e //UAF\n\nThis is confirmed by a KASAN report:\n\nBUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0\nWrite of size 8 at addr ffff88800aa09a18 by task bash/136\n...\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x55/0x70\n print_report+0xcf/0x610\n ? __run_timer_base.part.0+0x7d7/0x8c0\n kasan_report+0xb8/0xf0\n ? __run_timer_base.part.0+0x7d7/0x8c0\n __run_timer_base.part.0+0x7d7/0x8c0\n ? __pfx___run_timer_base.part.0+0x10/0x10\n ? __pfx_read_tsc+0x10/0x10\n ? ktime_get+0x60/0x140\n ? lapic_next_event+0x11/0x20\n ? clockevents_program_event+0x1d4/0x2a0\n run_timer_softirq+0xd1/0x190\n handle_softirqs+0x16a/0x550\n irq_exit_rcu+0xaf/0xe0\n sysvec_apic_timer_interrupt+0x70/0x80\n \u003c/IRQ\u003e\n...\nAllocated by task 1:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x7f/0x90\n otx2_ptp_init+0xb1/0x860\n otx2_probe+0x4eb/0xc30\n local_pci_probe+0xdc/0x190\n pci_device_probe+0x2fe/0x470\n really_probe+0x1ca/0x5c0\n __driver_probe_device+0x248/0x310\n driver_probe_device+0x44/0x120\n __driver_attach+0xd2/0x310\n bus_for_each_dev+0xed/0x170\n bus_add_driver+0x208/0x500\n driver_register+0x132/0x460\n do_one_initcall+0x89/0x300\n kernel_init_freeable+0x40d/0x720\n kernel_init+0x1a/0x150\n ret_from_fork+0x10c/0x1a0\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 136:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3a/0x60\n __kasan_slab_free+0x3f/0x50\n kfree+0x137/0x370\n otx2_ptp_destroy+0x38/0x80\n otx2_remove+0x10d/0x4c0\n pci_device_remove+0xa6/0x1d0\n device_release_driver_internal+0xf8/0x210\n pci_stop_bus_device+0x105/0x150\n pci_stop_and_remove_bus_device_locked+0x15/0x30\n remove_store+0xcc/0xe0\n kernfs_fop_write_iter+0x2c3/0x440\n vfs_write+0x871/0xd70\n ksys_write+0xee/0x1c0\n do_syscall_64+0xac/0x280\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n\nReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure\nthat the delayed work item is properly canceled before the otx2_ptp is\ndeallocated.\n\nThis bug was initially identified through static analysis. To reproduce\nand test it, I simulated the OcteonTX2 PCI device in QEMU and introduced\nartificial delays within the otx2_sync_tstamp() function to increase the\nlikelihood of triggering the bug."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Both halves of the race are driven by local operations \u2014 a `SIOCSHWTSTAMP`/ethtool tsconfig request on the octeontx2 netdev to arm the cyclic `synctstamp_work`, and local driver unbind/SR-IOV teardown/shutdown that reaches `otx2_ptp_destroy()`. No remotely supplied packet data reaches `otx2_sync_tstamp()`.\nAC:L - The attacker controls both sides: enabling `HWTSTAMP_TX_ONESTEP_SYNC` keeps the work self-requeuing every 250 ms indefinitely, and the callback blocks on `pfvf-\u003embox.lock` plus a mailbox round-trip with a 6000 ms timeout that the attacker can widen at will with concurrent mbox-consuming netdev operations, so the free reliably lands while the work is in flight (the commit itself notes the cyclic work makes the likelihood \"nonnegligible\"), and failed attempts are freely repeatable.\nPR:L - Arming the racing work requires only `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`, which an unprivileged host user obtains inside a user namespace over an SR-IOV VF delegated to their container/pod; the free side is then driven by attacker-induced VF teardown/driver rebind on container exit or by routine unbind/`.shutdown = otx2_remove`, with no real root needed by the attacker.\nUI:N - The attacker performs the hwtstamp configuration and induces the device teardown itself; no victim must open a file, mount anything, or otherwise cooperate.\nS:U - The use-after-free corrupts kernel slab memory and is exploited entirely within the kernel\u0027s own security authority, crossing no hypervisor, IOMMU, or sandbox boundary.\nC:H - After `kfree(ptp)` the still-running callback reads `ptp-\u003enic`, the timecounter state, and function pointers out of the reclaimed slab object, and the derived `ptp-\u003enic-\u003embox` pointer lets the attacker steer firmware mailbox reads/writes at attacker-chosen kernel addresses, giving a path to disclose arbitrary kernel memory.\nI:H - `otx2_sync_tstamp()` makes an indirect call through `ptp-\u003eptp_tstamp2nsec` located inside the freed allocation \u2014 a direct control-flow hijack primitive after heap grooming \u2014 and also writes `ptp-\u003etstamp`/`ptp-\u003ebase_ns` at fixed offsets into the reclaimed object, with the 250 ms self-requeue granting unlimited retries.\nA:H - The `delayed_work` timer is re-armed on `kfree()`d memory and fires every 250 ms forever, so even an unsuccessful attempt produces slab corruption, the KASAN-reported UAF write in `__run_timer_base`, and a kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:19.152Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2786879aebf363806a13d41e8d5f99202ddd23d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2cfefa14ce8137b17f99683f968bebf134b6a48"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff27e23b311fed4d25e3852e27ba693416d4c7b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ca20bb7b4bde72110c3ae78423cbfdd0157aa36"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8b4687151021db61841af983f1cb7be6915d4ef"
        }
      ],
      "title": "octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39944",
    "datePublished": "2025-10-04T07:31:06.339Z",
    "dateReserved": "2025-04-16T07:20:57.148Z",
    "dateUpdated": "2026-08-05T12:06:19.152Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39944",
      "date": "2026-08-14",
      "epss": "0.0014",
      "percentile": "0.0379"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-05T01:03:24.000Z",
      "cve": "CVE-2025-39944",
      "id": "msrc_CVE-2025-39944",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39944.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39944\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-04T08:15:47.480\",\"lastModified\":\"2026-07-30T06:23:59.413\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nocteontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()\\n\\nThe original code relies on cancel_delayed_work() in otx2_ptp_destroy(),\\nwhich does not ensure that the delayed work item synctstamp_work has fully\\ncompleted if it was already running. This leads to use-after-free scenarios\\nwhere otx2_ptp is deallocated by otx2_ptp_destroy(), while synctstamp_work\\nremains active and attempts to dereference otx2_ptp in otx2_sync_tstamp().\\nFurthermore, the synctstamp_work is cyclic, the likelihood of triggering\\nthe bug is nonnegligible.\\n\\nA typical race condition is illustrated below:\\n\\nCPU 0 (cleanup)           | CPU 1 (delayed work callback)\\notx2_remove()             |\\n  otx2_ptp_destroy()      | otx2_sync_tstamp()\\n    cancel_delayed_work() |\\n    kfree(ptp)            |\\n                          |   ptp = container_of(...); //UAF\\n                          |   ptp-\u003e //UAF\\n\\nThis is confirmed by a KASAN report:\\n\\nBUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0\\nWrite of size 8 at addr ffff88800aa09a18 by task bash/136\\n...\\nCall Trace:\\n \u003cIRQ\u003e\\n dump_stack_lvl+0x55/0x70\\n print_report+0xcf/0x610\\n ? __run_timer_base.part.0+0x7d7/0x8c0\\n kasan_report+0xb8/0xf0\\n ? __run_timer_base.part.0+0x7d7/0x8c0\\n __run_timer_base.part.0+0x7d7/0x8c0\\n ? __pfx___run_timer_base.part.0+0x10/0x10\\n ? __pfx_read_tsc+0x10/0x10\\n ? ktime_get+0x60/0x140\\n ? lapic_next_event+0x11/0x20\\n ? clockevents_program_event+0x1d4/0x2a0\\n run_timer_softirq+0xd1/0x190\\n handle_softirqs+0x16a/0x550\\n irq_exit_rcu+0xaf/0xe0\\n sysvec_apic_timer_interrupt+0x70/0x80\\n \u003c/IRQ\u003e\\n...\\nAllocated by task 1:\\n kasan_save_stack+0x24/0x50\\n kasan_save_track+0x14/0x30\\n __kasan_kmalloc+0x7f/0x90\\n otx2_ptp_init+0xb1/0x860\\n otx2_probe+0x4eb/0xc30\\n local_pci_probe+0xdc/0x190\\n pci_device_probe+0x2fe/0x470\\n really_probe+0x1ca/0x5c0\\n __driver_probe_device+0x248/0x310\\n driver_probe_device+0x44/0x120\\n __driver_attach+0xd2/0x310\\n bus_for_each_dev+0xed/0x170\\n bus_add_driver+0x208/0x500\\n driver_register+0x132/0x460\\n do_one_initcall+0x89/0x300\\n kernel_init_freeable+0x40d/0x720\\n kernel_init+0x1a/0x150\\n ret_from_fork+0x10c/0x1a0\\n ret_from_fork_asm+0x1a/0x30\\n\\nFreed by task 136:\\n kasan_save_stack+0x24/0x50\\n kasan_save_track+0x14/0x30\\n kasan_save_free_info+0x3a/0x60\\n __kasan_slab_free+0x3f/0x50\\n kfree+0x137/0x370\\n otx2_ptp_destroy+0x38/0x80\\n otx2_remove+0x10d/0x4c0\\n pci_device_remove+0xa6/0x1d0\\n device_release_driver_internal+0xf8/0x210\\n pci_stop_bus_device+0x105/0x150\\n pci_stop_and_remove_bus_device_locked+0x15/0x30\\n remove_store+0xcc/0xe0\\n kernfs_fop_write_iter+0x2c3/0x440\\n vfs_write+0x871/0xd70\\n ksys_write+0xee/0x1c0\\n do_syscall_64+0xac/0x280\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n...\\n\\nReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure\\nthat the delayed work item is properly canceled before the otx2_ptp is\\ndeallocated.\\n\\nThis bug was initially identified through static analysis. To reproduce\\nand test it, I simulated the OcteonTX2 PCI device in QEMU and introduced\\nartificial delays within the otx2_sync_tstamp() function to increase the\\nlikelihood of triggering the bug.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2958d17a898416c6193431676f6130b68a2cb9fc\",\"lessThan\":\"2786879aebf363806a13d41e8d5f99202ddd23d9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2958d17a898416c6193431676f6130b68a2cb9fc\",\"lessThan\":\"d2cfefa14ce8137b17f99683f968bebf134b6a48\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2958d17a898416c6193431676f6130b68a2cb9fc\",\"lessThan\":\"ff27e23b311fed4d25e3852e27ba693416d4c7b3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2958d17a898416c6193431676f6130b68a2cb9fc\",\"lessThan\":\"5ca20bb7b4bde72110c3ae78423cbfdd0157aa36\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2958d17a898416c6193431676f6130b68a2cb9fc\",\"lessThan\":\"f8b4687151021db61841af983f1cb7be6915d4ef\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.154\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.108\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.49\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.9\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1\",\"versionEndExcluding\":\"6.1.154\",\"matchCriteriaId\":\"A57D06D5-F248-4BF0-8580-9873AB71028A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.108\",\"matchCriteriaId\":\"A7E8EAEE-7731-4996-9578-696255D61EA2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.49\",\"matchCriteriaId\":\"CAA033E9-A2C5-4976-A83E-9804D8FB827F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.9\",\"matchCriteriaId\":\"638DD910-1189-4F5E-98BF-2D436B695112\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"39982C4B-716E-4B2F-8196-FA301F47807D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"340BEEA9-D70D-4290-B502-FBB1032353B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"47E4C5C0-079F-4838-971B-8C503D48FCC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A4516A6-C12E-42A4-8C0E-68AEF3264504\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2786879aebf363806a13d41e8d5f99202ddd23d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5ca20bb7b4bde72110c3ae78423cbfdd0157aa36\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d2cfefa14ce8137b17f99683f968bebf134b6a48\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f8b4687151021db61841af983f1cb7be6915d4ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff27e23b311fed4d25e3852e27ba693416d4c7b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:54:02+00:00",
      "cve": "CVE-2025-39944",
      "id": "CVE-2025-39944",
      "initial_release_date": "2025-10-04T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39944.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-19T17:47:27Z",
      "cve": "CVE-2025-39944",
      "id": "CVE-2025-39944",
      "initial_release_date": "2025-10-05T02:52:25Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "511",
      "product_status:known_not_affected": "154",
      "product_status:recommended": "500",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39944",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39944.json",
      "version": "43"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.