Security readout for executives and security teams
Plain-English summary
A race in the Linux OcteonTX2 network driver can access memory after it is freed during device removal. On systems using the affected driver and PTP timestamping, this may crash the kernel or potentially allow a locally authenticated user to compromise confidentiality, integrity, and availability.
Executive priority
Prioritize remediation on exposed OcteonTX2 hosts because successful triggering can affect all three security objectives at kernel scope. Treat other Linux systems as lower priority after confirming the affected driver or hardware path is absent. No supplied evidence establishes active exploitation.
Technical view
otx2_ptp_destroy() used cancel_delayed_work(), which could return while cyclic synctstamp_work was still executing. The callback could then dereference the freed otx2_ptp object in otx2_sync_tstamp(). The documented fix uses cancel_delayed_work_sync() before deallocation. KASAN confirmed a slab use-after-free.
Likely exposure
Exposure appears limited to Linux systems using the octeontx2-pf driver and its PTP timestamping path on a listed affected kernel version. The supplied data lists 6.1, 6.1.154, 6.6.108, 6.12.49, 6.16.9, and 6.17; it also contains an ambiguous “0” entry.
Exploitation context
The CVSS 3.1 score is 7.8 with local access and low privileges required. The source reports static-analysis discovery and controlled QEMU reproduction, not malicious exploitation. The supplied KEV status is false, so active exploitation is not established.
Researcher notes
The vulnerable cleanup does not synchronize with an already-running delayed callback. Because the work is cyclic, the source considers triggering likelihood non-negligible. KASAN recorded a write after otx2_ptp was freed during PCI device removal. Precise distribution package boundaries are not provided and require vendor mapping.
Mitigation direction
- Identify systems loading the octeontx2-pf driver and using PTP timestamping.
- Apply an appropriate vendor kernel update containing the referenced synchronous-work cancellation fix.
- Consult distribution or appliance vendor guidance to map the fix to supported kernel packages.
- Restrict unnecessary local access until affected systems are updated.
- Prioritize systems where OcteonTX2 PCI devices may be removed or drivers unloaded.
Validation and detection
- Record running kernel versions and compare them with vendor advisories and fixed packages.
- Confirm whether the octeontx2-pf driver and PTP functionality are present and active.
- Verify the installed kernel contains the relevant upstream stable fix.
- Review kernel logs for KASAN, use-after-free, timer, or octeontx2-pf fault indicators.
- Test device removal and driver cleanup safely in a non-production environment after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39944 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2786879aebf363806a13d41e8d5f99202ddd23d9CVE reference, Linux
- https://git.kernel.org/stable/c/d2cfefa14ce8137b17f99683f968bebf134b6a48CVE reference, Linux
- https://git.kernel.org/stable/c/ff27e23b311fed4d25e3852e27ba693416d4c7b3CVE reference, Linux
- https://git.kernel.org/stable/c/5ca20bb7b4bde72110c3ae78423cbfdd0157aa36CVE reference, Linux
- https://git.kernel.org/stable/c/f8b4687151021db61841af983f1cb7be6915d4efCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.