Use-After-Free Vulnerability in Linux Kernel's I2C Device Driver for TC358743

CVE-2025-39995

What is CVE-2025-39995?

A use-after-free vulnerability exists in the Linux kernel's I2C device driver for the TC358743. The issue arises during probe operations after timer initialization when orphaned timers continue running and reference a released state object. Specifically, the cyclic timer 'state->timer' doesn't guarantee termination before being destroyed, potentially leading to unsafe memory accesses and unpredictable behavior. This flaw can be leveraged via static analysis and emulated device interactions, highlighting the critical need for proper timer management to ensure system integrity and stability.

References