net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work
In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work The origin code calls cancel_delayed_work() in ocelot_stats_deinit() to cancel the cyclic delayed work item ocelot->stats_work. However, cancel_delayed_work() may fail to cancel the work item if it is already executing. While destroy_workqueue() does wait for all pending work items in the work queue to complete before destroying the work queue, it cannot prevent the delayed work item from being rescheduled within the ocelot_check_stats_work() function. This limitation exists because the delayed work item is only enqueued into the work queue after its timer expires. Before the timer expiration, destroy_workqueue() has no visibility of this pending work item. Once the work queue appears empty, destroy_workqueue() proceeds with destruction. When the timer eventually expires, the delayed work item gets queued again, leading to the following warning: workqueue: cannot queue ocelot_check_stats_work on wq ocelot-switch-stats WARNING: CPU: 2 PID: 0 at kernel/workqueue.c:2255 __queue_work+0x875/0xaf0 ... RIP: 0010:__queue_work+0x875/0xaf0 ... RSP: 0018:ffff88806d108b10 EFLAGS: 00010086 RAX: 0000000000000000 RBX: 0000000000000101 RCX: 0000000000000027 RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffff88806d123e88 RBP: ffffffff813c3170 R08: 0000000000000000 R09: ffffed100da247d2 R10: ffffed100da247d1 R11: ffff88806d123e8b R12: ffff88800c00f000 R13: f
CVE-2025-40003
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-40003
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a556c76adc052c979ef9e80f0cd3fa1379ff4943",
"lessThan": "c4672bdc4730d28ee8d9f65386599298047c045e",
"versionType": "git"
},
{
"status": "affected",
"version": "a556c76adc052c979ef9e80f0cd3fa1379ff4943",
"lessThan": "70acdd1eb35ffb3afdcb59e4c3bbb178da411d0f",
"versionType": "git"
},
{
"status": "affected",
"version": "a556c76adc052c979ef9e80f0cd3fa1379ff4943",
"lessThan": "c3363db5d0685a8d077ade706051bbccc75f7e14",
"versionType": "git"
},
{
"status": "affected",
"version": "a556c76adc052c979ef9e80f0cd3fa1379ff4943",
"lessThan": "bc9ea787079671cb19a8b25ff9f02be5ef6bfcf5",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ethernet/mscc/ocelot_stats.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.54",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.17.4",
"versionType": "semver",
"lessThanOrEqual": "6.17.*"
},
{
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/mscc/ocelot_stats.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-40003
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #46037 · Revision 1
- Added to Heist Feed
- Publisher date