CVE-2025-39978

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39978", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.150Z", "datePublished": "2025-10-15T07:55:58.949Z", "dateUpdated": "2026-11-10T12:37:26.359Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:06:47.202Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix potential use after free in otx2_tc_add_flow()\n\nThis code calls kfree_rcu(new_node, rcu) and then dereferences \"new_node\"\nand then dereferences it on the next line. Two lines later, we take\na mutex so I don't think this is an RCU safe region. Re-order it to do\nthe dereferences before queuing up the free."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached only through a local `RTM_NEWTFILTER` netlink message installing a tc flower filter with a police action on an octeontx2 PF/VF/representor netdev. There is no remote packet-processing path into `otx2_tc_add_flow()`.\nAC:L - The attacker deterministically forces the `free_leaf:` error path by installing police-action flower rules until MCAM/mbox resources are exhausted, and widens the RCU grace-period window at will by contending `nic->mbox.lock` from a second thread so `mutex_lock()` sleeps. Both the free and the reclaim/spray side are under attacker control.\nPR:L - Only CAP_NET_ADMIN over the netns owning the device is needed, and `otx2_setup_tc` is shared by the VF (`otx2_vf.c:535`) and representor (`rep.c:495`) drivers, whose netdevs are commonly delegated into container netns owned by unprivileged user namespaces where container-root holds CAP_NET_ADMIN with no init-namespace privilege.\nUI:N - The entire sequence is driven by the attacker's own netlink filter-install requests. No victim action or cooperation is involved.\nS:U - The use-after-free corrupts kernel heap and driver state within the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `struct otx2_tc_flow` is read back after reclaim, giving a read primitive over whatever slab object replaced it, and the stale `rq`/`leaf_profile` values are further exposed to userspace through `netdev_err()` kernel-log messages.\nI:H - `__clear_bit(new_node->rq, &nic->rq_bmap)` uses a UAF-derived u16 index against a single `unsigned long`, yielding an out-of-bounds bit clear up to ~8 KB into and past `struct otx2_nic` (mbox state, queue and function pointers), and the stale `leaf_profile` makes firmware tear down another flow's hardware policer, silently defeating QoS/rate-limit enforcement.\nA:H - A use-after-free on a slab object combined with an out-of-bounds bit clear into the driver's private structure reliably oopses the kernel or wedges the NIC's mailbox/queue state, and the attacker can repeat it at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c"], "versions": [{"version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "lessThan": "5723120423a753a220b8b2954b273838b9d7e74a", "status": "affected", "versionType": "git"}, {"version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "lessThan": "df2c071061ed52d2225d97b212d27ecedf456b8a", "status": "affected", "versionType": "git"}, {"version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "lessThan": "c41b2941a024d4ec7c768e16ffb10a74b188fced", "status": "affected", "versionType": "git"}, {"version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "lessThan": "a8a63f27c3a8a3714210d32b12fd0f16d0337414", "status": "affected", "versionType": "git"}, {"version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "lessThan": "d9c70e93ec5988ab07ad2a92d9f9d12867f02c56", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.155", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.109", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.50", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.10", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.155"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.12.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.16.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5723120423a753a220b8b2954b273838b9d7e74a"}, {"url": "https://git.kernel.org/stable/c/df2c071061ed52d2225d97b212d27ecedf456b8a"}, {"url": "https://git.kernel.org/stable/c/c41b2941a024d4ec7c768e16ffb10a74b188fced"}, {"url": "https://git.kernel.org/stable/c/a8a63f27c3a8a3714210d32b12fd0f16d0337414"}, {"url": "https://git.kernel.org/stable/c/d9c70e93ec5988ab07ad2a92d9f9d12867f02c56"}], "title": "octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-11-10T12:37:26.359Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-39978", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:55:41.623412Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:35.234Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-11-10T12:37:26.359Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-39978", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:55:41.623412Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:55:42.491Z"}}], "cna": {"title": "octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached only through a local `RTM_NEWTFILTER` netlink message installing a tc flower filter with a police action on an octeontx2 PF/VF/representor netdev. There is no remote packet-processing path into `otx2_tc_add_flow()`.\nAC:L - The attacker deterministically forces the `free_leaf:` error path by installing police-action flower rules until MCAM/mbox resources are exhausted, and widens the RCU grace-period window at will by contending `nic->mbox.lock` from a second thread so `mutex_lock()` sleeps. Both the free and the reclaim/spray side are under attacker control.\nPR:L - Only CAP_NET_ADMIN over the netns owning the device is needed, and `otx2_setup_tc` is shared by the VF (`otx2_vf.c:535`) and representor (`rep.c:495`) drivers, whose netdevs are commonly delegated into container netns owned by unprivileged user namespaces where container-root holds CAP_NET_ADMIN with no init-namespace privilege.\nUI:N - The entire sequence is driven by the attacker's own netlink filter-install requests. No victim action or cooperation is involved.\nS:U - The use-after-free corrupts kernel heap and driver state within the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `struct otx2_tc_flow` is read back after reclaim, giving a read primitive over whatever slab object replaced it, and the stale `rq`/`leaf_profile` values are further exposed to userspace through `netdev_err()` kernel-log messages.\nI:H - `__clear_bit(new_node->rq, &nic->rq_bmap)` uses a UAF-derived u16 index against a single `unsigned long`, yielding an out-of-bounds bit clear up to ~8 KB into and past `struct otx2_nic` (mbox state, queue and function pointers), and the stale `leaf_profile` makes firmware tear down another flow's hardware policer, silently defeating QoS/rate-limit enforcement.\nA:H - A use-after-free on a slab object combined with an out-of-bounds bit clear into the driver's private structure reliably oopses the kernel or wedges the NIC's mailbox/queue state, and the attacker can repeat it at will."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "lessThan": "5723120423a753a220b8b2954b273838b9d7e74a", "versionType": "git"}, {"status": "affected", "version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "lessThan": "df2c071061ed52d2225d97b212d27ecedf456b8a", "versionType": "git"}, {"status": "affected", "version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "lessThan": "c41b2941a024d4ec7c768e16ffb10a74b188fced", "versionType": "git"}, {"status": "affected", "version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "lessThan": "a8a63f27c3a8a3714210d32b12fd0f16d0337414", "versionType": "git"}, {"status": "affected", "version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "lessThan": "d9c70e93ec5988ab07ad2a92d9f9d12867f02c56", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"status": "unaffected", "version": "0", "lessThan": "5.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.155", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.109", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.50", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.16.10", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5723120423a753a220b8b2954b273838b9d7e74a"}, {"url": "https://git.kernel.org/stable/c/df2c071061ed52d2225d97b212d27ecedf456b8a"}, {"url": "https://git.kernel.org/stable/c/c41b2941a024d4ec7c768e16ffb10a74b188fced"}, {"url": "https://git.kernel.org/stable/c/a8a63f27c3a8a3714210d32b12fd0f16d0337414"}, {"url": "https://git.kernel.org/stable/c/d9c70e93ec5988ab07ad2a92d9f9d12867f02c56"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix potential use after free in otx2_tc_add_flow()\n\nThis code calls kfree_rcu(new_node, rcu) and then dereferences \"new_node\"\nand then dereferences it on the next line. Two lines later, we take\na mutex so I don't think this is an RCU safe region. Re-order it to do\nthe dereferences before queuing up the free."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.155", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.109", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.50", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16.10", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17", "versionStartIncluding": "5.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:06:47.202Z"}}}, "cveMetadata": {"cveId": "CVE-2025-39978", "state": "PUBLISHED", "dateUpdated": "2026-11-10T12:37:26.359Z", "dateReserved": "2025-04-16T07:20:57.150Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-10-15T07:55:58.949Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5723120423a753a220b8b2954b273838b9d7e74a", "status": "affected", "version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "versionType": "git"}, {"lessThan": "df2c071061ed52d2225d97b212d27ecedf456b8a", "status": "affected", "version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "versionType": "git"}, {"lessThan": "c41b2941a024d4ec7c768e16ffb10a74b188fced", "status": "affected", "version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "versionType": "git"}, {"lessThan": "a8a63f27c3a8a3714210d32b12fd0f16d0337414", "status": "affected", "version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "versionType": "git"}, {"lessThan": "d9c70e93ec5988ab07ad2a92d9f9d12867f02c56", "status": "affected", "version": "68fbff68dbea35f9e6f7649dd22fce492a5aedac", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.155", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.109", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.50", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix potential use after free in otx2_tc_add_flow()\n\nThis code calls kfree_rcu(new_node, rcu) and then dereferences \"new_node\"\nand then dereferences it on the next line. Two lines later, we take\na mutex so I don't think this is an RCU safe region. Re-order it to do\nthe dereferences before queuing up the free."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nocteontx2-pf: Correcci\u00f3n de un uso potencial despu\u00e9s de liberar en otx2_tc_add_flow()\n\nEste c\u00f3digo llama a kfree_rcu(new_node, rcu) y luego desreferencia 'new_node' y luego lo desreferencia en la siguiente l\u00ednea. Dos l\u00edneas m\u00e1s tarde, tomamos un mutex, as\u00ed que no creo que esta sea una regi\u00f3n segura para RCU. Reord\u00e9nelo para hacer las desreferencias antes de poner en cola la liberaci\u00f3n."}], "id": "CVE-2025-39978", "lastModified": "2026-11-10T13:17:53.577", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-39978", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:55:41.623412Z", "version": "2.0.3"}}]}, "published": "2025-10-15T08:15:35.640", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5723120423a753a220b8b2954b273838b9d7e74a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a8a63f27c3a8a3714210d32b12fd0f16d0337414"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c41b2941a024d4ec7c768e16ffb10a74b188fced"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d9c70e93ec5988ab07ad2a92d9f9d12867f02c56"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/df2c071061ed52d2225d97b212d27ecedf456b8a"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()", "id": "2404094", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404094"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nocteontx2-pf: Fix potential use after free in otx2_tc_add_flow()\nThis code calls kfree_rcu(new_node, rcu) and then dereferences \"new_node\"\nand then dereferences it on the next line. Two lines later, we take\na mutex so I don't think this is an RCU safe region. Re-order it to do\nthe dereferences before queuing up the free."], "name": "CVE-2025-39978", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39978\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39978\nhttps://lore.kernel.org/linux-cve-announce/2025101558-CVE-2025-39978-d538@gregkh/T"], "threat_severity": "Important"}

{"created": "2025-10-20T13:27:06.564154+00:00", "updated": "2025-10-20T13:27:06.564188+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}