Skip to main content

Linux Kernel CVE-2025-39978

HIGH
2025-10-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local vector (AV:L) with low complexity; PR:L reflects the CAP_NET_ADMIN-level access needed to reach the TC offload path; kernel UAF yields high C/I/A within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
6.4 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 30, 2026 - 06:37 vuln.today
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
CVE Published
Oct 15, 2025 - 08:15 cve.org
UNKNOWN (no severity yet)
CVE Published
Oct 15, 2025 - 08:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()

This code calls kfree_rcu(new_node, rcu) and then dereferences "new_node" and then dereferences it on the next line. Two lines later, we take a mutex so I don't think this is an RCU safe region. Re-order it to do the dereferences before queuing up the free.

AnalysisAI

Use-after-free in the Linux kernel's octeontx2-pf network driver allows a local low-privileged user to trigger memory corruption via the otx2_tc_add_flow() traffic-control offload path, where new_node is dereferenced after being queued for freeing with kfree_rcu() outside a valid RCU read-side region. Successful exploitation can cause a denial of service (kernel crash) and, depending on heap state, potential local privilege escalation. There is no public exploit identified at time of analysis, and the low EPSS score (0.19%) reflects the narrow, hardware-specific attack surface.

Technical ContextAI

The affected code lives in the octeontx2-pf driver, which supports Marvell OcteonTX2/CN10K network interface controllers and their TC (traffic control) flow-offload feature. The root cause is a classic use-after-free (CWE-416): otx2_tc_add_flow() calls kfree_rcu(new_node, rcu) to schedule the node for deferred freeing, but then dereferences new_node on subsequent lines and later acquires a mutex - meaning the code is not in an RCU read-side critical section that would guarantee the object's validity. Because kfree_rcu only defers the free past a grace period (not indefinitely, and not protected here by rcu_read_lock), the object can be reclaimed and reused while still referenced. The upstream fix reorders operations so all dereferences complete before the free is queued.

Affected ProductsAI

The vulnerability affects the Linux kernel's octeontx2-pf driver (Marvell OcteonTX2/CN10K PF networking). Exact affected version ranges are not enumerated in the provided data (CPE strings were not supplied), but the presence of five separate stable-tree fix commits (git.kernel.org commits 5723120, a8a63f2, c41b294, d9c70e9, df2c071) indicates the fix was backported across multiple maintained stable branches, implying several kernel series were affected prior to those backports. Siemens has issued advisory SSA-019113 (https://cert-portal.siemens.com/productcert/html/ssa-019113.html) indicating certain Siemens products embedding the affected kernel are also impacted. Authoritative fix references are the kernel.org stable commits listed above.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update containing the fix commits (git.kernel.org/stable/c/5723120423a753a220b8b2954b273838b9d7e74a and the four related backports a8a63f2, c41b294, d9c70e9, df2c071) by updating to the patched stable kernel provided by your distribution. Siemens-managed products should follow advisory SSA-019113 (https://cert-portal.siemens.com/productcert/html/ssa-019113.html) for vendor-specific fixed firmware/images. As a compensating control on systems that cannot be patched immediately, restrict CAP_NET_ADMIN and TC-offload configuration to trusted administrators, and if the hardware is not present or the offload feature is unused, this code path is not reachable so no action is required beyond confirming the driver is not loaded (blacklisting the otx2 modules where the NIC is absent). These controls have minimal side effects on hosts without OcteonTX2 hardware but will disable TC flow offload where it is in use.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.6.17.8.134 Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.65 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.88 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.105 Affected

Share

CVE-2025-39978 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy