Linux Kernel CVE-2025-39994

In the Linux kernel, the following vulnerability has been resolved:

media: tuner: xc5000: Fix use-after-free in xc5000_release

The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep has fully completed if it was already running. This leads to use-after-free scenarios where xc5000_release() may free the xc5000_priv while timer_sleep is still active and attempts to dereference the xc5000_priv.

A typical race condition is illustrated below:

CPU 0 (release thread) | CPU 1 (delayed work callback) xc5000_release() | xc5000_do_timer_sleep() cancel_delayed_work() | hybrid_tuner_release_state(priv) | kfree(priv) |

| priv = container_of() // UAF Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the timer_sleep is properly canceled before the xc5000_priv memory is deallocated.

A deadlock concern was considered: xc5000_release() is called in a process context and is not holding any locks that the timer_sleep work item might also need. Therefore, the use of the _sync() variant is safe here.

This bug was initially identified through static analysis.

[hverkuil: fix typo in Subject: tunner -> tuner]

The Linux kernel media/DVB subsystem, specifically the xc5000 tuner driver (drivers/media/tuners/xc5000.c), is affected across multiple maintained branches, as indicated by the nine stable-tree fix commits on git.kernel.org (e.g. 3f876cd47ed8, 40b7a19f321e, 4266f012806f, 71ed8b81a490, 9a00de20ed8b, bc4ffd962ce1, df0303b48395, e2f5eaafc030, effb1c195838). No CPE strings were provided in the input, so exact version ranges are not enumerated here; the presence of multiple backport commits indicates the bug is long-standing and was patched across several stable series. Only systems that build/load the xc5000 tuner module and expose a compatible TV tuner device are meaningfully exposed.