{"id":"CVE-2025-39978","state":"PUBLISHED","title":"octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix potential use after free in otx2_tc_add_flow()\n\nThis code calls kfree_rcu(new_node, rcu) and then dereferences \"new_node\"\nand then dereferences it on the next line.  Two lines later, we take\na mutex so I don't think this is an RCU safe region.  Re-order it to do\nthe dereferences before queuing up the free.","publishedAt":"2025-10-15T07:55:58.949Z","updatedAt":"2026-10-15T22:02:35.234Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"68fbff68dbea35f9e6f7649dd22fce492a5aedac","status":"affected","lessThan":"5723120423a753a220b8b2954b273838b9d7e74a","versionType":"git"},{"version":"68fbff68dbea35f9e6f7649dd22fce492a5aedac","status":"affected","lessThan":"df2c071061ed52d2225d97b212d27ecedf456b8a","versionType":"git"},{"version":"68fbff68dbea35f9e6f7649dd22fce492a5aedac","status":"affected","lessThan":"c41b2941a024d4ec7c768e16ffb10a74b188fced","versionType":"git"},{"version":"68fbff68dbea35f9e6f7649dd22fce492a5aedac","status":"affected","lessThan":"a8a63f27c3a8a3714210d32b12fd0f16d0337414","versionType":"git"},{"version":"68fbff68dbea35f9e6f7649dd22fce492a5aedac","status":"affected","lessThan":"d9c70e93ec5988ab07ad2a92d9f9d12867f02c56","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.14","versionType":"semver"},{"version":"6.1.155","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.109","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.50","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.10","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c"]}],"references":["https://git.kernel.org/stable/c/5723120423a753a220b8b2954b273838b9d7e74a","https://git.kernel.org/stable/c/df2c071061ed52d2225d97b212d27ecedf456b8a","https://git.kernel.org/stable/c/c41b2941a024d4ec7c768e16ffb10a74b188fced","https://git.kernel.org/stable/c/a8a63f27c3a8a3714210d32b12fd0f16d0337414","https://git.kernel.org/stable/c/d9c70e93ec5988ab07ad2a92d9f9d12867f02c56","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/39xxx/CVE-2025-39978.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39978","state":"PUBLISHED","datePublished":"2025-10-15T07:55:58.949Z","dateUpdated":"2026-10-15T22:02:35.234Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.150Z"},"containers":{"cna":{"title":"octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix potential use after free in otx2_tc_add_flow()\n\nThis code calls kfree_rcu(new_node, rcu) and then dereferences \"new_node\"\nand then dereferences it on the next line.  Two lines later, we take\na mutex so I don't think this is an RCU safe region.  Re-order it to do\nthe dereferences before queuing up the free."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"68fbff68dbea35f9e6f7649dd22fce492a5aedac","status":"affected","lessThan":"5723120423a753a220b8b2954b273838b9d7e74a","versionType":"git"},{"version":"68fbff68dbea35f9e6f7649dd22fce492a5aedac","status":"affected","lessThan":"df2c071061ed52d2225d97b212d27ecedf456b8a","versionType":"git"},{"version":"68fbff68dbea35f9e6f7649dd22fce492a5aedac","status":"affected","lessThan":"c41b2941a024d4ec7c768e16ffb10a74b188fced","versionType":"git"},{"version":"68fbff68dbea35f9e6f7649dd22fce492a5aedac","status":"affected","lessThan":"a8a63f27c3a8a3714210d32b12fd0f16d0337414","versionType":"git"},{"version":"68fbff68dbea35f9e6f7649dd22fce492a5aedac","status":"affected","lessThan":"d9c70e93ec5988ab07ad2a92d9f9d12867f02c56","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.14","versionType":"semver"},{"version":"6.1.155","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.109","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.50","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.10","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/5723120423a753a220b8b2954b273838b9d7e74a"},{"url":"https://git.kernel.org/stable/c/df2c071061ed52d2225d97b212d27ecedf456b8a"},{"url":"https://git.kernel.org/stable/c/c41b2941a024d4ec7c768e16ffb10a74b188fced"},{"url":"https://git.kernel.org/stable/c/a8a63f27c3a8a3714210d32b12fd0f16d0337414"},{"url":"https://git.kernel.org/stable/c/d9c70e93ec5988ab07ad2a92d9f9d12867f02c56"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached only through a local `RTM_NEWTFILTER` netlink message installing a tc flower filter with a police action on an octeontx2 PF/VF/representor netdev. There is no remote packet-processing path into `otx2_tc_add_flow()`.\nAC:L - The attacker deterministically forces the `free_leaf:` error path by installing police-action flower rules until MCAM/mbox resources are exhausted, and widens the RCU grace-period window at will by contending `nic->mbox.lock` from a second thread so `mutex_lock()` sleeps. Both the free and the reclaim/spray side are under attacker control.\nPR:L - Only CAP_NET_ADMIN over the netns owning the device is needed, and `otx2_setup_tc` is shared by the VF (`otx2_vf.c:535`) and representor (`rep.c:495`) drivers, whose netdevs are commonly delegated into container netns owned by unprivileged user namespaces where container-root holds CAP_NET_ADMIN with no init-namespace privilege.\nUI:N - The entire sequence is driven by the attacker's own netlink filter-install requests. No victim action or cooperation is involved.\nS:U - The use-after-free corrupts kernel heap and driver state within the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `struct otx2_tc_flow` is read back after reclaim, giving a read primitive over whatever slab object replaced it, and the stale `rq`/`leaf_profile` values are further exposed to userspace through `netdev_err()` kernel-log messages.\nI:H - `__clear_bit(new_node->rq, &nic->rq_bmap)` uses a UAF-derived u16 index against a single `unsigned long`, yielding an out-of-bounds bit clear up to ~8 KB into and past `struct otx2_nic` (mbox state, queue and function pointers), and the stale `leaf_profile` makes firmware tear down another flow's hardware policer, silently defeating QoS/rate-limit enforcement.\nA:H - A use-after-free on a slab object combined with an out-of-bounds bit clear into the driver's private structure reliably oopses the kernel or wedges the NIC's mailbox/queue state, and the attacker can repeat it at will."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:06:47.202Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.1.155"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.6.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.12.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.16.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.17"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:08:45.893Z"},"x_adpType":"supplier"},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-39978","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:55:41.623412Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T22:02:35.234Z"}}]}}}