GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-39945 (GCVE-0-2025-39945)

Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2026-08-05 12:06
VLAI
Title
cnic: Fix use-after-free bugs in cnic_delete_task
Summary
In the Linux kernel, the following vulnerability has been resolved: cnic: Fix use-after-free bugs in cnic_delete_task The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(), which does not guarantee that the delayed work item 'delete_task' has fully completed if it was already running. Additionally, the delayed work item is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after the cyclic work items have finished executing, a delayed work item may still exist in the workqueue. This leads to use-after-free scenarios where the cnic_dev is deallocated by cnic_free_dev(), while delete_task remains active and attempt to dereference cnic_dev in cnic_delete_task(). A typical race condition is illustrated below: CPU 0 (cleanup) | CPU 1 (delayed work callback) cnic_netdev_event() | cnic_stop_hw() | cnic_delete_task() cnic_cm_stop_bnx2x_hw() | ... cancel_delayed_work() | /* the queue_delayed_work() flush_workqueue() | executes after flush_workqueue()*/ | queue_delayed_work() cnic_free_dev(dev)//free | cnic_delete_task() //new instance | dev = cp->dev; //use Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the cyclic delayed work item is properly canceled and that any ongoing execution of the work item completes before the cnic_dev is deallocated. Furthermore, since cancel_delayed_work_sync() uses __flush_work(work, true) to synchronously wait for any currently executing instance of the work item to finish, the flush_workqueue() becomes redundant and should be removed. This bug was identified through static analysis. To reproduce the issue and validate the fix, I simulated the cnic PCI device in QEMU and introduced intentional delays — such as inserting calls to ssleep() within the cnic_delete_task() function — to increase the likelihood of triggering the bug.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 20:41 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fdf24086f4752aee5dfb40143c736250df017820 , < fde6e73189f40ebcf0633aed2b68e731c25f3aa3 (git)
Affected: fdf24086f4752aee5dfb40143c736250df017820 , < 7b6a5b0a6b392263c3767fc945b311ea04b34bbd (git)
Affected: fdf24086f4752aee5dfb40143c736250df017820 , < 0405055930264ea8fd26f4131466fa7652e5e47d (git)
Affected: fdf24086f4752aee5dfb40143c736250df017820 , < e1fcd4a9c09feac0902a65615e866dbf22616125 (git)
Affected: fdf24086f4752aee5dfb40143c736250df017820 , < 8eeb2091e72d75df8ceaa2172638d61b4cf8929a (git)
Affected: fdf24086f4752aee5dfb40143c736250df017820 , < 6e33a7eed587062ca8161ad1f4584882a860d697 (git)
Affected: fdf24086f4752aee5dfb40143c736250df017820 , < 0627e1481676669cae2df0d85b5ff13e7d24c390 (git)
Affected: fdf24086f4752aee5dfb40143c736250df017820 , < cfa7d9b1e3a8604afc84e9e51d789c29574fb216 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.37
Unaffected: 0 , < 2.6.37 (semver)
Unaffected: 5.4.300 , ≤ 5.4.* (semver)
Unaffected: 5.10.245 , ≤ 5.10.* (semver)
Unaffected: 5.15.194 , ≤ 5.15.* (semver)
Unaffected: 6.1.154 , ≤ 6.1.* (semver)
Unaffected: 6.6.108 , ≤ 6.6.* (semver)
Unaffected: 6.12.49 , ≤ 6.12.* (semver)
Unaffected: 6.16.9 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39945",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:21.785248Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:11.566Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/cnic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fde6e73189f40ebcf0633aed2b68e731c25f3aa3",
              "status": "affected",
              "version": "fdf24086f4752aee5dfb40143c736250df017820",
              "versionType": "git"
            },
            {
              "lessThan": "7b6a5b0a6b392263c3767fc945b311ea04b34bbd",
              "status": "affected",
              "version": "fdf24086f4752aee5dfb40143c736250df017820",
              "versionType": "git"
            },
            {
              "lessThan": "0405055930264ea8fd26f4131466fa7652e5e47d",
              "status": "affected",
              "version": "fdf24086f4752aee5dfb40143c736250df017820",
              "versionType": "git"
            },
            {
              "lessThan": "e1fcd4a9c09feac0902a65615e866dbf22616125",
              "status": "affected",
              "version": "fdf24086f4752aee5dfb40143c736250df017820",
              "versionType": "git"
            },
            {
              "lessThan": "8eeb2091e72d75df8ceaa2172638d61b4cf8929a",
              "status": "affected",
              "version": "fdf24086f4752aee5dfb40143c736250df017820",
              "versionType": "git"
            },
            {
              "lessThan": "6e33a7eed587062ca8161ad1f4584882a860d697",
              "status": "affected",
              "version": "fdf24086f4752aee5dfb40143c736250df017820",
              "versionType": "git"
            },
            {
              "lessThan": "0627e1481676669cae2df0d85b5ff13e7d24c390",
              "status": "affected",
              "version": "fdf24086f4752aee5dfb40143c736250df017820",
              "versionType": "git"
            },
            {
              "lessThan": "cfa7d9b1e3a8604afc84e9e51d789c29574fb216",
              "status": "affected",
              "version": "fdf24086f4752aee5dfb40143c736250df017820",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/cnic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.37"
            },
            {
              "lessThan": "2.6.37",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.300",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.154",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.108",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.9",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncnic: Fix use-after-free bugs in cnic_delete_task\n\nThe original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(),\nwhich does not guarantee that the delayed work item \u0027delete_task\u0027 has\nfully completed if it was already running. Additionally, the delayed work\nitem is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only\nblocks and waits for work items that were already queued to the\nworkqueue prior to its invocation. Any work items submitted after\nflush_workqueue() is called are not included in the set of tasks that the\nflush operation awaits. This means that after the cyclic work items have\nfinished executing, a delayed work item may still exist in the workqueue.\nThis leads to use-after-free scenarios where the cnic_dev is deallocated\nby cnic_free_dev(), while delete_task remains active and attempt to\ndereference cnic_dev in cnic_delete_task().\n\nA typical race condition is illustrated below:\n\nCPU 0 (cleanup)              | CPU 1 (delayed work callback)\ncnic_netdev_event()          |\n  cnic_stop_hw()             | cnic_delete_task()\n    cnic_cm_stop_bnx2x_hw()  | ...\n      cancel_delayed_work()  | /* the queue_delayed_work()\n      flush_workqueue()      |    executes after flush_workqueue()*/\n                             | queue_delayed_work()\n  cnic_free_dev(dev)//free   | cnic_delete_task() //new instance\n                             |   dev = cp-\u003edev; //use\n\nReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure\nthat the cyclic delayed work item is properly canceled and that any\nongoing execution of the work item completes before the cnic_dev is\ndeallocated. Furthermore, since cancel_delayed_work_sync() uses\n__flush_work(work, true) to synchronously wait for any currently\nexecuting instance of the work item to finish, the flush_workqueue()\nbecomes redundant and should be removed.\n\nThis bug was identified through static analysis. To reproduce the issue\nand validate the fix, I simulated the cnic PCI device in QEMU and\nintroduced intentional delays \u2014 such as inserting calls to ssleep()\nwithin the cnic_delete_task() function \u2014 to increase the likelihood\nof triggering the bug."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable teardown path is reached only through local administrative operations on the netdev (link down, MTU/ring change, driver unbind, netns move) and local iSCSI/FCoE offload management; no remotely supplied data reaches `cnic_cm_stop_bnx2x_hw()` or `cnic_delete_task()`.\nAC:L - The attacker controls both sides of the race \u2014 issuing iSCSI/FCoE connection destroys keeps `delete_task` in its 10 ms self-requeue cycle for the entire 2-second grace window while the interface-down is triggered, giving hundreds of attempts per try, and holding the cnic UIO chardev open stretches `cnic_stop_hw()`\u0027s wait loop to 1.5 s to widen the window further.\nPR:L - In the delegated-NIC container deployment, a bnx2x port placed into a network namespace lets a user-namespace-root (unprivileged host user) with `CAP_NET_ADMIN` over that netns drive `NETDEV_GOING_DOWN` and, via netns teardown/device migration, the `NETDEV_UNREGISTER` that reaches `cnic_free_dev()` \u2014 so no real host root is needed for the free side.\nUI:N - The attacker performs both the connection-destroy activity and the interface teardown; no victim action or cooperation is required at any point.\nS:U - The use-after-free corrupts kernel slab memory and is exploited within the kernel\u0027s own security authority, with no crossing of a hypervisor, IOMMU, or sandbox boundary.\nC:H - The freed `cnic_dev`/`cnic_local` chunk and `cp-\u003ectx_tbl` can be reclaimed by attacker-sprayed data, and the surviving work reads function pointers, DMA addresses, and ULP handles out of that freed memory, giving a path to disclose arbitrary kernel memory.\nI:H - `cnic_delete_task()` performs `test_and_clear_bit()` writes into the freed `ctx_tbl`, `kfree()`s pointers read from freed memory (arbitrary-free primitive), and makes an indirect call through `cp-\u003eethdev-\u003edrv_ctl` located in the freed allocation \u2014 a control-flow hijack primitive after heap grooming.\nA:H - The stale `delayed_work` timer is armed on `kfree()`d memory and the callback dereferences freed structures, so even an unsuccessful exploitation attempt reliably produces slab corruption, an oops, or a kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:20.222Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fde6e73189f40ebcf0633aed2b68e731c25f3aa3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b6a5b0a6b392263c3767fc945b311ea04b34bbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/0405055930264ea8fd26f4131466fa7652e5e47d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1fcd4a9c09feac0902a65615e866dbf22616125"
        },
        {
          "url": "https://git.kernel.org/stable/c/8eeb2091e72d75df8ceaa2172638d61b4cf8929a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e33a7eed587062ca8161ad1f4584882a860d697"
        },
        {
          "url": "https://git.kernel.org/stable/c/0627e1481676669cae2df0d85b5ff13e7d24c390"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfa7d9b1e3a8604afc84e9e51d789c29574fb216"
        }
      ],
      "title": "cnic: Fix use-after-free bugs in cnic_delete_task",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39945",
    "datePublished": "2025-10-04T07:31:07.109Z",
    "dateReserved": "2025-04-16T07:20:57.148Z",
    "dateUpdated": "2026-08-05T12:06:20.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39945",
      "date": "2026-09-16",
      "epss": "0.00158",
      "percentile": "0.05364"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-05T01:02:58.000Z",
      "cve": "CVE-2025-39945",
      "id": "msrc_CVE-2025-39945",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "cnic: Fix use-after-free bugs in cnic_delete_task",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39945.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39945\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-04T08:15:47.613\",\"lastModified\":\"2026-07-30T06:23:59.567\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncnic: Fix use-after-free bugs in cnic_delete_task\\n\\nThe original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(),\\nwhich does not guarantee that the delayed work item \u0027delete_task\u0027 has\\nfully completed if it was already running. Additionally, the delayed work\\nitem is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only\\nblocks and waits for work items that were already queued to the\\nworkqueue prior to its invocation. Any work items submitted after\\nflush_workqueue() is called are not included in the set of tasks that the\\nflush operation awaits. This means that after the cyclic work items have\\nfinished executing, a delayed work item may still exist in the workqueue.\\nThis leads to use-after-free scenarios where the cnic_dev is deallocated\\nby cnic_free_dev(), while delete_task remains active and attempt to\\ndereference cnic_dev in cnic_delete_task().\\n\\nA typical race condition is illustrated below:\\n\\nCPU 0 (cleanup)              | CPU 1 (delayed work callback)\\ncnic_netdev_event()          |\\n  cnic_stop_hw()             | cnic_delete_task()\\n    cnic_cm_stop_bnx2x_hw()  | ...\\n      cancel_delayed_work()  | /* the queue_delayed_work()\\n      flush_workqueue()      |    executes after flush_workqueue()*/\\n                             | queue_delayed_work()\\n  cnic_free_dev(dev)//free   | cnic_delete_task() //new instance\\n                             |   dev = cp-\u003edev; //use\\n\\nReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure\\nthat the cyclic delayed work item is properly canceled and that any\\nongoing execution of the work item completes before the cnic_dev is\\ndeallocated. Furthermore, since cancel_delayed_work_sync() uses\\n__flush_work(work, true) to synchronously wait for any currently\\nexecuting instance of the work item to finish, the flush_workqueue()\\nbecomes redundant and should be removed.\\n\\nThis bug was identified through static analysis. To reproduce the issue\\nand validate the fix, I simulated the cnic PCI device in QEMU and\\nintroduced intentional delays \u2014 such as inserting calls to ssleep()\\nwithin the cnic_delete_task() function \u2014 to increase the likelihood\\nof triggering the bug.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/cnic.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fdf24086f4752aee5dfb40143c736250df017820\",\"lessThan\":\"fde6e73189f40ebcf0633aed2b68e731c25f3aa3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fdf24086f4752aee5dfb40143c736250df017820\",\"lessThan\":\"7b6a5b0a6b392263c3767fc945b311ea04b34bbd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fdf24086f4752aee5dfb40143c736250df017820\",\"lessThan\":\"0405055930264ea8fd26f4131466fa7652e5e47d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fdf24086f4752aee5dfb40143c736250df017820\",\"lessThan\":\"e1fcd4a9c09feac0902a65615e866dbf22616125\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fdf24086f4752aee5dfb40143c736250df017820\",\"lessThan\":\"8eeb2091e72d75df8ceaa2172638d61b4cf8929a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fdf24086f4752aee5dfb40143c736250df017820\",\"lessThan\":\"6e33a7eed587062ca8161ad1f4584882a860d697\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fdf24086f4752aee5dfb40143c736250df017820\",\"lessThan\":\"0627e1481676669cae2df0d85b5ff13e7d24c390\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fdf24086f4752aee5dfb40143c736250df017820\",\"lessThan\":\"cfa7d9b1e3a8604afc84e9e51d789c29574fb216\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/cnic.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.37\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.37\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.300\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.245\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.194\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.154\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.108\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.49\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.9\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T20:41:21.785248Z\",\"id\":\"CVE-2025-39945\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.37\",\"versionEndExcluding\":\"5.4.300\",\"matchCriteriaId\":\"7175A0F5-9125-4D84-A39A-3FA75A464894\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.245\",\"matchCriteriaId\":\"B0E443AF-02FC-45A1-9CD7-3F80A65F1A15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.194\",\"matchCriteriaId\":\"CF862263-DC8D-4324-A52A-DA1D7880B35A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.154\",\"matchCriteriaId\":\"E49CD91E-FC55-45B0-BB63-9AD5F5D70CAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.108\",\"matchCriteriaId\":\"A7E8EAEE-7731-4996-9578-696255D61EA2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.49\",\"matchCriteriaId\":\"CAA033E9-A2C5-4976-A83E-9804D8FB827F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.9\",\"matchCriteriaId\":\"638DD910-1189-4F5E-98BF-2D436B695112\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"39982C4B-716E-4B2F-8196-FA301F47807D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"340BEEA9-D70D-4290-B502-FBB1032353B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"47E4C5C0-079F-4838-971B-8C503D48FCC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A4516A6-C12E-42A4-8C0E-68AEF3264504\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0405055930264ea8fd26f4131466fa7652e5e47d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0627e1481676669cae2df0d85b5ff13e7d24c390\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6e33a7eed587062ca8161ad1f4584882a860d697\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7b6a5b0a6b392263c3767fc945b311ea04b34bbd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8eeb2091e72d75df8ceaa2172638d61b4cf8929a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cfa7d9b1e3a8604afc84e9e51d789c29574fb216\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e1fcd4a9c09feac0902a65615e866dbf22616125\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fde6e73189f40ebcf0633aed2b68e731c25f3aa3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:53:55+00:00",
      "cve": "CVE-2025-39945",
      "id": "CVE-2025-39945",
      "initial_release_date": "2025-10-04T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cnic: Fix use-after-free bugs in cnic_delete_task",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39945.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T16:56:53Z",
      "cve": "CVE-2025-39945",
      "id": "CVE-2025-39945",
      "initial_release_date": "2025-10-05T02:52:24Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "199",
      "product_status:recommended": "697",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39945",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39945.json",
      "version": "53"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-39945\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:41:21.785248Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:38:17.045Z\"}}], \"cna\": {\"title\": \"cnic: Fix use-after-free bugs in cnic_delete_task\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"fdf24086f4752aee5dfb40143c736250df017820\", \"lessThan\": \"fde6e73189f40ebcf0633aed2b68e731c25f3aa3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdf24086f4752aee5dfb40143c736250df017820\", \"lessThan\": \"7b6a5b0a6b392263c3767fc945b311ea04b34bbd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdf24086f4752aee5dfb40143c736250df017820\", \"lessThan\": \"0405055930264ea8fd26f4131466fa7652e5e47d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdf24086f4752aee5dfb40143c736250df017820\", \"lessThan\": \"e1fcd4a9c09feac0902a65615e866dbf22616125\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdf24086f4752aee5dfb40143c736250df017820\", \"lessThan\": \"8eeb2091e72d75df8ceaa2172638d61b4cf8929a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdf24086f4752aee5dfb40143c736250df017820\", \"lessThan\": \"6e33a7eed587062ca8161ad1f4584882a860d697\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdf24086f4752aee5dfb40143c736250df017820\", \"lessThan\": \"0627e1481676669cae2df0d85b5ff13e7d24c390\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fdf24086f4752aee5dfb40143c736250df017820\", \"lessThan\": \"cfa7d9b1e3a8604afc84e9e51d789c29574fb216\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/broadcom/cnic.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.37\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.37\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.300\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.245\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.194\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.154\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.108\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.49\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.16.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.16.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/broadcom/cnic.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/fde6e73189f40ebcf0633aed2b68e731c25f3aa3\"}, {\"url\": \"https://git.kernel.org/stable/c/7b6a5b0a6b392263c3767fc945b311ea04b34bbd\"}, {\"url\": \"https://git.kernel.org/stable/c/0405055930264ea8fd26f4131466fa7652e5e47d\"}, {\"url\": \"https://git.kernel.org/stable/c/e1fcd4a9c09feac0902a65615e866dbf22616125\"}, {\"url\": \"https://git.kernel.org/stable/c/8eeb2091e72d75df8ceaa2172638d61b4cf8929a\"}, {\"url\": \"https://git.kernel.org/stable/c/6e33a7eed587062ca8161ad1f4584882a860d697\"}, {\"url\": \"https://git.kernel.org/stable/c/0627e1481676669cae2df0d85b5ff13e7d24c390\"}, {\"url\": \"https://git.kernel.org/stable/c/cfa7d9b1e3a8604afc84e9e51d789c29574fb216\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncnic: Fix use-after-free bugs in cnic_delete_task\\n\\nThe original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(),\\nwhich does not guarantee that the delayed work item \u0027delete_task\u0027 has\\nfully completed if it was already running. Additionally, the delayed work\\nitem is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only\\nblocks and waits for work items that were already queued to the\\nworkqueue prior to its invocation. Any work items submitted after\\nflush_workqueue() is called are not included in the set of tasks that the\\nflush operation awaits. This means that after the cyclic work items have\\nfinished executing, a delayed work item may still exist in the workqueue.\\nThis leads to use-after-free scenarios where the cnic_dev is deallocated\\nby cnic_free_dev(), while delete_task remains active and attempt to\\ndereference cnic_dev in cnic_delete_task().\\n\\nA typical race condition is illustrated below:\\n\\nCPU 0 (cleanup)              | CPU 1 (delayed work callback)\\ncnic_netdev_event()          |\\n  cnic_stop_hw()             | cnic_delete_task()\\n    cnic_cm_stop_bnx2x_hw()  | ...\\n      cancel_delayed_work()  | /* the queue_delayed_work()\\n      flush_workqueue()      |    executes after flush_workqueue()*/\\n                             | queue_delayed_work()\\n  cnic_free_dev(dev)//free   | cnic_delete_task() //new instance\\n                             |   dev = cp-\u003edev; //use\\n\\nReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure\\nthat the cyclic delayed work item is properly canceled and that any\\nongoing execution of the work item completes before the cnic_dev is\\ndeallocated. Furthermore, since cancel_delayed_work_sync() uses\\n__flush_work(work, true) to synchronously wait for any currently\\nexecuting instance of the work item to finish, the flush_workqueue()\\nbecomes redundant and should be removed.\\n\\nThis bug was identified through static analysis. To reproduce the issue\\nand validate the fix, I simulated the cnic PCI device in QEMU and\\nintroduced intentional delays \\u2014 such as inserting calls to ssleep()\\nwithin the cnic_delete_task() function \\u2014 to increase the likelihood\\nof triggering the bug.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.300\", \"versionStartIncluding\": \"2.6.37\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.245\", \"versionStartIncluding\": \"2.6.37\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.194\", \"versionStartIncluding\": \"2.6.37\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.154\", \"versionStartIncluding\": \"2.6.37\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.108\", \"versionStartIncluding\": \"2.6.37\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.49\", \"versionStartIncluding\": \"2.6.37\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.9\", \"versionStartIncluding\": \"2.6.37\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17\", \"versionStartIncluding\": \"2.6.37\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-07-30T05:58:43.618Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-39945\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-30T05:58:43.618Z\", \"dateReserved\": \"2025-04-16T07:20:57.148Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-10-04T07:31:07.109Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.