Use-After-Free Vulnerability in Linux Kernel Affecting cnic Component

CVE-2025-39945

What is CVE-2025-39945?

A vulnerability in the Linux kernel related to the cnic component could lead to use-after-free issues during the cancellation of delayed work items. The problem arises in the execution flow, where the delayed work item may still be active after the associated device is deallocated. This can cause dereferencing of invalid memory regions, leading to undefined behavior. The issue is exacerbated by a race condition between concurrent CPU operations. A fix has been proposed to replace cancel_delayed_work() with cancel_delayed_work_sync(), ensuring proper synchronization and safe resource management.

References