CVE-2025-39994

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

media: tuner: xc5000: Fix use-after-free in xc5000_release

The original code uses cancel_delayed_work() in xc5000_release(), which

does not guarantee that the delayed work item timer_sleep has fully

completed if it was already running. This leads to use-after-free scenarios

where xc5000_release() may free the xc5000_priv while timer_sleep is still

active and attempts to dereference the xc5000_priv.

A typical race condition is illustrated below:

CPU 0 (release thread) | CPU 1 (delayed work callback)

xc5000_release() | xc5000_do_timer_sleep()

cancel_delayed_work() |

hybrid_tuner_release_state(priv) |

kfree(priv) |

| priv = container_of() // UAF

Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure

that the timer_sleep is properly canceled before the xc5000_priv memory

is

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References