Linux Kernel Vulnerability in mISDN hfcpci Module

CVE-2025-39833

What is CVE-2025-39833?

A vulnerability in the mISDN hfcpci module of the Linux kernel can lead to errors during module unloading. When the CONFIG_DEBUG_OBJECTS_TIMERS is enabled, attempting to remove the hfcpci module can trigger warnings indicating that an assertion for an uninitialized timer is failing. Specifically, a warning occurs if the timer associated with hfc_tl is not properly initialized. This issue can lead to log clutter and potentially unstable behavior in systems that rely on this module. The resolution involves initializing timers correctly using the DEFINE_TIMER macro and utilizing mod_timer instead of manual timeout updates to ensure stability.

References