High 7.3Published Oct 15, 2025

CVE-2025-39994media: tuner: xc5000: Fix use-after-free in xc5000_release

Updated under an hour ago (Oct 28, 2026, 5:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: media: tuner: xc5000: Fix use-after-free in xc5000_release The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep has fully completed if it was already running. This leads to use-after-free scenarios where xc5000_release() may free the xc5000_priv while timer_sleep is still active and attempts to dereference the xc5000_priv. A typical race condition is illustrated below: CPU 0 (release thread) | CPU 1 (delayed work callback) xc5000_release() | xc5000_do_timer_sleep() cancel_delayed_work() | hybrid_tuner_release_state(priv) | kfree(priv) | | priv = container_of() // UAF Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the timer_sleep is properly canceled before the xc5000_priv memory is deallocated. A deadlock concern was considered: xc5000_release() is called in a process context and is not holding any locks that the timer_sleep work item might also need. Therefore, the use of the _sync() variant is safe here. This bug was initially identified through static analysis. [hverkuil: fix typo in Subject: tunner -> tuner]

CVSS: 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 before bc4ffd962ce16a154c44c68853b9d93f5b6fc4b8; from f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 before e2f5eaafc0306a76fb1cb760aae804b065b8a341; from f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 before 3f876cd47ed8bca1e28d68435845949f51f90703; from f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 before df0303b4839520b84d9367c2fad65b13650a4d42; from f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 before 71ed8b81a4906cb785966910f39cf7f5ad60a69e; from f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 before effb1c19583bca7022fa641a70766de45c6d41ac; from f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 before 9a00de20ed8ba90888479749b87bc1532cded4ce; from f7a27ff1fb77e114d1059a5eb2ed1cffdc508ce8 before 4266f012806fc18e46da4a04d130df59a4946f93; and 1 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/bc4ffd962ce16a154c44c68853b9d93f5b6fc4b8
https://git.kernel.org/stable/c/e2f5eaafc0306a76fb1cb760aae804b065b8a341
https://git.kernel.org/stable/c/3f876cd47ed8bca1e28d68435845949f51f90703
https://git.kernel.org/stable/c/df0303b4839520b84d9367c2fad65b13650a4d42
https://git.kernel.org/stable/c/71ed8b81a4906cb785966910f39cf7f5ad60a69e
https://git.kernel.org/stable/c/effb1c19583bca7022fa641a70766de45c6d41ac
https://git.kernel.org/stable/c/9a00de20ed8ba90888479749b87bc1532cded4ce
https://git.kernel.org/stable/c/4266f012806fc18e46da4a04d130df59a4946f93
https://git.kernel.org/stable/c/40b7a19f321e65789612ebaca966472055dab48c

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.