High 7.8Published Oct 15, 2025

CVE-2025-39978octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()

Updated under an hour ago (Oct 28, 2026, 10:23 AM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() This code calls kfree_rcu(new_node, rcu) and then dereferences "new_node" and then dereferences it on the next line. Two lines later, we take a mutex so I don't think this is an RCU safe region. Re-order it to do the dereferences before queuing up the free.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 68fbff68dbea35f9e6f7649dd22fce492a5aedac before 5723120423a753a220b8b2954b273838b9d7e74a; from 68fbff68dbea35f9e6f7649dd22fce492a5aedac before df2c071061ed52d2225d97b212d27ecedf456b8a; from 68fbff68dbea35f9e6f7649dd22fce492a5aedac before c41b2941a024d4ec7c768e16ffb10a74b188fced; from 68fbff68dbea35f9e6f7649dd22fce492a5aedac before a8a63f27c3a8a3714210d32b12fd0f16d0337414; from 68fbff68dbea35f9e6f7649dd22fce492a5aedac before d9c70e93ec5988ab07ad2a92d9f9d12867f02c56	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP

References

References

https://git.kernel.org/stable/c/5723120423a753a220b8b2954b273838b9d7e74a
https://git.kernel.org/stable/c/df2c071061ed52d2225d97b212d27ecedf456b8a
https://git.kernel.org/stable/c/c41b2941a024d4ec7c768e16ffb10a74b188fced
https://git.kernel.org/stable/c/a8a63f27c3a8a3714210d32b12fd0f16d0337414
https://git.kernel.org/stable/c/d9c70e93ec5988ab07ad2a92d9f9d12867f02c56
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.